Nextcloud · disclosed reports
Information Disclosure
89 disclosed reports · $2,108 paid · 65 valid · 20 informative · 3 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 89
- valid
- 65
- paid a bounty
- 14
Every one of the 89 is a mark on the map. Named now: 79 to 89, most upvoted first.
- Retrieval and alteration of exposed media on Android Oreo
- https://newsletter.nextcloud.com Directory listening and Information Disclosure
- WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED)
- External Storage - WebDAV - New user has access to storage from deleted user (same user-ID)
- information disclose
- Share tokens for public calendars disclosed (NC-SA-2017-011)
- Deny access to download.nextcloud.com + folders
- Leaking sensitive information through JSON file path.
- Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/
- Directory Listing In Subdomain Of nextcloud.com
- Username Enumeration
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.