Nextcloud · disclosed reports
Information Disclosure
89 disclosed reports · $2,108 paid · 65 valid · 20 informative · 3 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 89
- valid
- 65
- paid a bounty
- 14
Every one of the 89 is a mark on the map. Named now: 27 to 52, most upvoted first.
- Reference caching can leak data to unauthorized users
- Nextcloud domain and name of every user leaked to lookup server
- Talk / spreed: Disclosure of Room names and participants for password protected rooms
- Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API
- Information exposure in in guzzlehttp/guzzle (https://github.com/nextcloud/3rdparty/tree/master/guzzlehttp/guzzle)
- Lack of Brute force protection while joining video call in talk section which is password protected
- https://portal.nextcloud.com/.htaccess file is readable
- Disclosure of administrators via JSON on nextcloud.com Wordpress
- Default settings leak federated cloud id to lookup server of all users
- The session token in the URL
- Last video frame is still sent after video is disabled in a call
- GIT Detected
- bug reporting template encourages users to paste config file with passwords
- Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic
- User files is disclosed when someone called while the screen is locked
- Files Drop: WebDAV endpoint is leaking existence of resources
- help.nextcloud Email Address/Username enumeration
- Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory
- Directory listing is enabled that exposes non public data through multiple path
- Wordpress Users Disclosure
- User Information Disclosure via REST API
- Private/confidential setting of calendar events is ignored on activity stream
- Android content provider exposes password-protected share password hashes
- Calendar and addressbook names disclosed (NC-SA-2017-012)
- Wordpress: Directory Traversal / Denial of Serivce
- Error in Deleting Deck cards attachment reveals the full path of the website
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.