Nextcloud · disclosed reports
Information Disclosure
89 disclosed reports · $2,108 paid · 65 valid · 20 informative · 3 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 89
- valid
- 65
- paid a bounty
- 14
Every one of the 89 is a mark on the map. Named now: 53 to 78, most upvoted first.
- Text app leaks file path of shared files
- SQL exception in JSON format
- Wordpress Version Disclosure Bug On Nextcloud
- Directory listening enabled in: 88.198.160.130
- the complete server installation path is visible in cloud/user endpoint
- Anonymous file drop page ignores user profile visibility restrictions
- Banner Grabbing - Apache Server Version Disclousure
- Unauthenticated 'display name' information leak on enumeration of login names
- Shared file link - password protection bypass under certain conditions
- Information Disclosure of .htaccess file in Private Server/Subdomain
- Email ID Disclosure.
- Vulnerable Javascript library
- Brute force protections don't work
- Full path disclosure vulnerability via Upload .htaccess file
- Disclosed Version of PORTS SSH|HTTP|SSL
- Banner Grabbing - Apache Server Version Disclosure
- Information Exposure Through Directory Listing
- Information disclosure
- WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available
- nextcloud.com: Directory listening for 'wp-includes' forders
- Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe
- Information Exposure Through Directory Listing vulnerability
- Nextcloud update checks leaks information
- Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers
- Veracode and security audit record are publicly available
- Password authentication at newsletter.nextcloud.com discloses username list
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.