Nextcloud · disclosed reports
Access Control
98 disclosed reports · $10,170 paid · 98 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 98
- valid
- 98
- paid a bounty
- 34
Every one of the 98 is a mark on the map. Named now: 1 to 26, most upvoted first.
- User can delete data in shared folders he's not autorized to access
- Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)
- Re-Sharing allows increase of privileges
- View-only guests could see deleted Collectives pages in the trashbin
- ID4me feature of OpenID connect app available even when disabled
- Valid share tokens allow to access tempory upload files of share owner
- Arbitrary Board Preference Injection via Deck Config API
- Default Nextcloud Server and Android Client leak sharee searches to Nextcloud
- Easy way to create a new Deck board without permission
- Download permissions can be changed by resharer
- Can download files on Android app without permission
- Delete external storage of any user
- User can copy locked folders and gain access to the contents
- Blind SSRF Vulnerability in Appstore Release Upload Form
- End-to-end encrypted file-drops can be made inaccessible
- Can download files by zipping the folder
- Scoped apptokens can be changed by that very apptoken
- Deck app allowed user with "Can share" permission to modify permissions of other non-owners
- Read-only users can restore old versions
- Expired reshare links allow access to all files in share
- Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups
- Can reshare read&share only folder with more permissions
- Bypass password confirmation via Context-dependent access control (CDCA)
- Group admins can remove arbitrary data from "data" directory (including admin data)
- files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet
- Admins can change authentication details of user configured external storage
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.