Nextcloud · disclosed reports
Insecure Direct Object Reference
22 disclosed reports · $1,100 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 22
- paid a bounty
- 5
Every one of the 22 is a mark on the map. Named now: 1 to 22, most upvoted first.
- Missing ownership check on remote wipe endpoint
- Private circle can be added to another circle via API despite visibility restriction
- WebAuthn app was updated based on public key
- TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot
- Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
- Calendar app allowed booking appointments without the generated token
- BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
- IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos
- Ability to read any emails through IDOR on Nextcloud Mail
- Share information of Tables app is not limited to affected users
- Tables app allowed users to view columns metadata information of any table
- Missing ownership check in Tables app allows moving columns into tables of other users
- Enabling Birthday Contact to any user
- IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email
- Participants were able to blindly delete poll drafts of other users by ID
- Possibility to delete files attached to deck cards of other users
- Access control missing while viewing the attachments in the "All boards"
- Team membership information returned on API level based on ID
- Registered users can change app password permissions for any user
- Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board
- Ownership check missing when updating or deleting attachments
- New users can read all Nextcloud Deck data from previous user with same username
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.