Nextcloud · disclosed reports
Misconfiguration and Insecure Design
56 disclosed reports · $450 paid · 41 valid · 9 informative · 5 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 56
- valid
- 41
- paid a bounty
- 4
Every one of the 56 is a mark on the map. Named now: 27 to 52, most upvoted first.
- HTTP-Basic Authentication on logs.nextcloud.com
- URI scheme bypass in mail app lead to HTML content spoof and opener control
- More content spoofing through dir param in the files app
- nextcloud.com: Content Injection Custom 404 Error
- Clickjacking In https://demo.nextcloud.com
- Email Spoofing
- Content Spoofing in "files" app
- Content spoofing due to the improper behavior of the 403 page in Private Server
- stats.nextcloud.com: Content Injection
- Missing X-Content-Type-Options
- Content (Text) Injection at https://nextcloud.com
- Login Hints on Admin Panel
- **minor issue ** -Nextcloud 10.0 session issue with desktop client and android client
- demo.nextcloud.com: Content spoofing due to default Apache Error Page
- Content injection in subdomain
- Content Spoofing/Text Injection - docs.nextcloud.org
- No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers
- Content Spoofing
- Content Injection - apps.nextcloud.com
- Content spoofing in cloud.nextcloud.com
- Content Injection in subdomain
- Content Injection 404 page
- Nextcloud server software: Content Spoofing
- Nextcloud Clickjacking Vulnerability
- Clickjacking on https://download.nextcloud.com/
- Clickjacking on https://download.nextcloud.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.