Nextcloud · disclosed reports
Input Validation and Logic
23 disclosed reports · $400 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 23
- paid a bounty
- 4
Every one of the 23 is a mark on the map. Named now: 1 to 23, most upvoted first.
- No rate limiting for confirmation email lead to huge Mass mailings
- Improper input validation in emoji field leads to sidebar UI denial of service
- Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes
- Notes app can be tricked into using a received share created before the user logged in
- Exposing debug.log file leads to server full path disclosure
- Non-admin users can reset app allowlist to the default
- Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables
- Unrestricted file upload on the image of contacts
- User scoped external storage can be used to gather credentials of other users
- Calendar attachments of local files are offered to downloaded
- Gallery: No feedback for invalid password
- Deck app: Invalid tag color is accepted by API and breaks frontend UI
- Missing Duplicate Check allowing Multiple Retention Rules per System Tag
- When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL
- No rate limiting on sinup page
- bypass forced password protection via circles app
- Federated share accepting/declining is not logged in audit log
- objectId in share location can be set to open arbitrary URL or Deeplinks
- Targeted phishing attacks in Login flow v2
- Email Spoofing
- Name collision of shared folders
- SignUp using Fake Email
- Bypass hide download Nextcloud Share
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.