Nextcloud · disclosed reports
No weakness filed
57 disclosed reports · $4,250 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 57
- paid a bounty
- 10
Every one of the 57 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/
- User deletion is not handled properly everywhere
- File-drop content is visible through the gallery app
- Two-factor authentication enforcement bypass
- Authentication bypass in Global Site Selector allows an attacker to log in as any user
- Mail stored HTML injection in subject text
- Unauthenticated SSRF via Public Reference API -Sharing Token Bypass
- tabnabbing in roundcube webmail
- I am because bug
- Leak arbitrary file under nextcloud android client privacy directory
- https://help.nextcloud.com::: Web cache poisoning attack
- Nextcloud Tables app - inserting rows to an arbitrary table possible
- Deck app allows to spoof file extensions by using RTLO characters
- Server side request forgery (SSRF) on nextcloud implementation.
- Clients do not verify server public key
- Ransomware protection is missing extentions take 2
- public webdav endpoint not bruteforce protected
- Twitter Account hijack @nextcloudfrance
- Email Spoofing Vulnerability from nextcloud.
- Android app does not clear end to end encryption keys
- End to end encryption public key is not properly verified on Desktop and Android
- Only the file extensions are checked, not the MIME types as configured
- Design Issues on ( ███ ) Lead to show ( IPS of Users )
- Wordpress 4.7.1
- Add to your nextcloud endpoint is not properly protected
- User Editable nextcloud Wiki pages of Public Repositories
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.