Nextcloud · disclosed reports
Information Disclosure
89 disclosed reports · $2,108 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 89
- paid a bounty
- 14
Every one of the 89 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Access to all files of remote user through shared file
- Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope
- Directory Listing of publicly available assets
- Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lock
- SVG filter primitives bypass remote image blocking, enabling email tracking without consent.
- Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes
- Events information leaked with shared calendars on recurrence exceptions
- Unauthenticated testing endpoint of notify_push expose internal IP
- Email Enumeration via Password-Protected Share Identity Verification
- Mail auto configurator can be tricked into sending account information to wrong servers
- Incomplete sanitization in SVG preview provider
- Possible to enumerate valid files in password protected shares/files drop shares as well as spam folder with files
- Attachments folder for Text app is accessible on Files Drop/Password protected shares
- Database error shown to the user when using a long guest name in richdocuments
- External storage - global credentials returned to the client side in plaintext
- Cards in Deck are readable by any user
- Bypass of privacy filter / tracking pixel blocker
- Notification implicit PendingIntent in com.nextcloud.client allows to access contacts
- Folder architecture and Filesizes of private file drop shares can be getten
- Error when editing a calendar appointment returns stacktrace and query
- Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log]
- HEIC image preview can be used to invoke Imagick
- Android - Possible to intercept broadcasts about uploaded files
- Messages can still be seen on conversation after expiring when cron is misconfigured
- Guests can continue to receive video streams from call after being removed from a conversation
- Exposing debug.log file leads to server full path disclosure
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.