Nextcloud · disclosed reports
Misconfiguration and Insecure Design
56 disclosed reports · $450 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 56
- paid a bounty
- 4
Every one of the 56 is a mark on the map. Named now: 1 to 26, most upvoted first.
- OAuth2 "authorization_code" is valid indefinetly
- Email not verified when changing afterwards on apps.nextcloud.com
- No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deleted
- Username and Access Token Disclousure
- Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11
- Suspicious login app ships old league/flysystem version
- Content Spoofing /Text Injection in https://docs.nextcloud.com
- Content Spoofing/Text Injection in https://demo.nextcloud.com
- No Rate Limiting on stats.nextcloud.com login
- WordPress vulnerable to multiple attacks at https://nextcloud.com
- Invalid request may lead content spoofing for phishing
- Content spoofing in lookup.nextcloud.com
- Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file
- Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/
- Click Jacking Nextcloud
- WordPress < 4.8.2 vulnerable to multiple attacks
- Disabled user can reset their password
- Expired SSL certificate
- Ability to control the filename when uploading a logo or favicon on theming
- Passcode Protection in Android Devices Can be Bypassed.
- Content Spoofing/Text Injection in nextcloud.com
- Avatar image upload and bypass real image verification
- RTLO character allowed in shared files
- Missing Rate Limiting protection leading to mass triggering of e-mails
- Content spoofing due to the improper behavior of the 403 page
- Missing SPF Flags on nextcloud.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.