Nextcloud · disclosed reports
Access Control
105 disclosed reports · $10,170 paid · 98 valid · 6 informative · 1 duplicate
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 105
- valid
- 98
- paid a bounty
- 34
Every one of the 105 is a mark on the map. Named now: 27 to 52, most upvoted first.
- Passcode bypass on Talk Android app
- Nextcloud mail does not respect download permissions in shares
- Profile of disabled user stays accessible
- Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4
- Error in Booking an appointment reveals the full path of the website
- "Secure View" aka "Hide Download" can be bypassed easily
- Full Passcode bypass on Nextcloud App iOS
- Users can modify tags on files that do not belong to them
- Sensitive files/ data exists post deletion of user account
- Missing permission check when removing a photo from an album
- Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
- see card comments after remove shared board
- Disabled download shares still allow download through preview images
- FederationController::remoteWopiToken() returns full Wopi entity without token type validation
- Users can set up workflows using restricted and invisible system tags
- Chat room member disclosure via autocomplete API
- Missing rate limiting on password reset functionality allows to send lot of emails
- User with read-only access to a share can gain write access to sub-folders in the share
- xmlrpc.php is enabled - Nextcloud
- Access control issue -- [Allow file system access not validated when using session auth]
- Shared smart albums in the Photos app can expose files outside the album owner's configured source folders
- Missing server side controls when editing the board’s sharing permissions per user
- File drop public link can also be converted to federated share
- Take over a mail account due missing validation of account id
- Access Control: Inject tasks into other users decks
- Virtual Data Room / Hide download on collabora is easy to bypass
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.