Nextcloud · disclosed reports
Misconfiguration and Insecure Design
41 disclosed reports · $450 paid · 41 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 41
- valid
- 41
- paid a bounty
- 4
Every one of the 41 is a mark on the map. Named now: 1 to 26, most upvoted first.
- OAuth2 "authorization_code" is valid indefinetly
- Email not verified when changing afterwards on apps.nextcloud.com
- No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deleted
- Username and Access Token Disclousure
- Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11
- Suspicious login app ships old league/flysystem version
- Content Spoofing /Text Injection in https://docs.nextcloud.com
- Content Spoofing/Text Injection in https://demo.nextcloud.com
- WordPress vulnerable to multiple attacks at https://nextcloud.com
- Invalid request may lead content spoofing for phishing
- Content spoofing in lookup.nextcloud.com
- Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file
- Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/
- WordPress < 4.8.2 vulnerable to multiple attacks
- Disabled user can reset their password
- Expired SSL certificate
- Ability to control the filename when uploading a logo or favicon on theming
- Content Spoofing/Text Injection in nextcloud.com
- Missing Rate Limiting protection leading to mass triggering of e-mails
- Content spoofing due to the improper behavior of the 403 page
- URI scheme bypass in mail app lead to HTML content spoof and opener control
- More content spoofing through dir param in the files app
- nextcloud.com: Content Injection Custom 404 Error
- Content Spoofing in "files" app
- Content spoofing due to the improper behavior of the 403 page in Private Server
- stats.nextcloud.com: Content Injection
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.