Bug bounty program · HackerOne
Most upvoted reports613
- #851807ValidAnalysedCode injection possible with malformed Nextcloud Talk chat commandsNextcloud · Command and Code Injection · 2020 · needs: a user account · OS command injection–317votes
- #642515ValidUser can delete data in shared folders he's not autorized to accessNextcloud · Access Control · 2020–173votes
- #258084ValidAccess to all files of remote user through shared fileNextcloud · Information Disclosure · 2020–154votes
- #1170024ValidAttacker can obtain write access to any federated share/public linkNextcloud · Authentication · 2021$4,000142votes
- #819807ValidMissing ownership check on remote wipe endpointNextcloud · Insecure Direct Object Reference · 2020$500141votes
- #546753ValidRemote Code Execution via Extract App PluginNextcloud · Command and Code Injection · 2019–124votes
- #2946927ValidSensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/Nextcloud · No weakness recorded · 2025 · Low–113votes
- #3617729ValidMail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scopeNextcloud · Information Disclosure · 2026 · Medium$250101votes
- #3625210ValidPIN bypass in PassCodeActivity via back buttonNextcloud · Authentication · 2026 · Medium$150101votes
- #3572848ValidGroup restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)Nextcloud · Access Control · 2026 · Medium$150100votes
Subdomains1,642
23 covered by the program's own scope · 0 first seen this week
Name suggestsAnything
1,642 names
| Name | Scope | First seen |
|---|---|---|
| abcvyz.nextcloud.com | Not in the scope | 2026-11-14 |
| academy.nextcloud.com | Not in the scope | 2026-11-14 |
| aio-testing.nextcloud.comtest | Not in the scope | 2026-11-14 |
| amxtestenv.nextcloud.com | Not in the scope | 2026-11-14 |
| cool.amxtestenv.nextcloud.com | Not in the scope | 2026-11-14 |
| push.amxtestenv.nextcloud.com | Not in the scope | 2026-11-14 |
| antitrust.nextcloud.com | Not in the scope | 2026-11-14 |
| api.nextcloud.comapi | Not in the scope | 2026-11-14 |
| apps.nextcloud.com | In scope | 2026-11-14 |
| static.apps.nextcloud.com | In scope | 2026-11-14 |
| usercontent.apps.nextcloud.com | In scope | 2026-11-14 |
| auth.nextcloud.comauth | In scope | 2026-11-14 |
| auth2.nextcloud.comauth | Not in the scope | 2026-11-14 |
| backportbot.nextcloud.com | Not in the scope | 2026-11-14 |
| backup.nextcloud.comdata | Not in the scope | 2026-11-14 |
| blabla.nextcloud.com | Not in the scope | 2026-11-14 |
| bmi-demo.nextcloud.comtest | Not in the scope | 2026-11-14 |
| backport.bots.nextcloud.com | Not in the scope | 2026-11-14 |
| stalebot.bots.nextcloud.com | Not in the scope | 2026-11-14 |
| ci-assets.nextcloud.comci | Not in the scope | 2026-11-14 |
| click.nextcloud.com | Not in the scope | 2026-11-14 |
| cloud.nextcloud.com | Listed out of scope | 2026-11-14 |
| collabora.cloud.nextcloud.com | Not in the scope | 2026-11-14 |
| push.cloud.nextcloud.com | Not in the scope | 2026-11-14 |
| staging.push.cloud.nextcloud.comstaging | Not in the scope | 2026-11-14 |
| staging.cloud.nextcloud.comstaging | Not in the scope | 2026-11-14 |
| collabora.nextcloud.com | Not in the scope | 2026-11-14 |
| collabora-staging.nextcloud.comstaging | Not in the scope | 2026-11-14 |
| collabora-test.nextcloud.comtest | Not in the scope | 2026-11-14 |
| collabora-test2.nextcloud.comtest | Not in the scope | 2026-11-14 |
| staging.collabora.nextcloud.comstaging | Not in the scope | 2026-11-14 |
| conf.nextcloud.com | Listed out of scope | 2026-11-14 |
| conference.nextcloud.com | Not in the scope | 2026-11-14 |
| connectivity.nextcloud.com | Not in the scope | 2026-11-14 |
| crm.nextcloud.com | In scope | 2026-11-14 |
| customerpush.nextcloud.com | Not in the scope | 2026-11-14 |
| c0001.customerpush.nextcloud.com | Not in the scope | 2026-11-14 |
| c0002.customerpush.nextcloud.com | Not in the scope | 2026-11-14 |
| c0003.customerpush.nextcloud.com | Not in the scope | 2026-11-14 |
| c0004.customerpush.nextcloud.com | Not in the scope | 2026-11-14 |
| c0005.customerpush.nextcloud.com | Not in the scope | 2026-11-14 |
| c0006.customerpush.nextcloud.com | Not in the scope | 2026-11-14 |
| c0007.customerpush.nextcloud.com | Not in the scope | 2026-11-14 |
| customerupdates.nextcloud.com | In scope | 2026-11-14 |
| demo.nextcloud.comtest | Listed out of scope | 2026-11-14 |
| demo-push-notifications.nextcloud.comtest | Not in the scope | 2026-11-14 |
| demo1.nextcloud.comtest | Not in the scope | 2026-11-14 |
| demo2.nextcloud.comtest | Not in the scope | 2026-11-14 |
| dev.nextcloud.comdev | Not in the scope | 2026-11-14 |
| doc.nextcloud.com | Not in the scope | 2026-11-14 |
| docs.nextcloud.com | In scope | 2026-11-14 |
| docs2.nextcloud.com | Not in the scope | 2026-11-14 |
| download.nextcloud.com | In scope | 2026-11-14 |
| drone.nextcloud.comci | Listed out of scope | 2026-11-14 |
| drone-woker4.nextcloud.comci | Not in the scope | 2026-11-14 |
| drone-worker1.nextcloud.comci | Not in the scope | 2026-11-14 |
| drone-worker2.nextcloud.comci | Not in the scope | 2026-11-14 |
| drone-worker3.nextcloud.comci | Not in the scope | 2026-11-14 |
| drone-worker4.nextcloud.comci | Not in the scope | 2026-11-14 |
| drone-worker5.nextcloud.comci | Not in the scope | 2026-11-14 |
| dsi.nextcloud.com | Not in the scope | 2026-11-14 |
| eaio-testing.nextcloud.comtest | Not in the scope | 2026-11-14 |
| eo.nextcloud.com | Not in the scope | 2026-11-14 |
| filemi.nextcloud.com | Not in the scope | 2026-11-14 |
| gaia-x.nextcloud.com | Not in the scope | 2026-11-14 |
| garm.nextcloud.com | Not in the scope | 2026-11-14 |
| garm1.nextcloud.com | Not in the scope | 2026-11-14 |
| garm2.nextcloud.com | Not in the scope | 2026-11-14 |
| garm3.nextcloud.com | Not in the scope | 2026-11-14 |
| garm4.nextcloud.com | Not in the scope | 2026-11-14 |
| garm5.nextcloud.com | Not in the scope | 2026-11-14 |
| garm6.nextcloud.com | Not in the scope | 2026-11-14 |
| garm7.nextcloud.com | Not in the scope | 2026-11-14 |
| go.nextcloud.com | Not in the scope | 2026-11-14 |
| handbook.nextcloud.com | Not in the scope | 2026-11-14 |
| help.nextcloud.com | In scope | 2026-11-14 |
| hpb-server.nextcloud.com | Not in the scope | 2026-11-14 |
| idm.nextcloud.com | Not in the scope | 2026-11-14 |
| ihopenooneeverregistersthissubdomain.nextcloud.com | Not in the scope | 2026-11-14 |
| jank.nextcloud.com | Not in the scope | 2026-11-14 |
| knowledge.nextcloud.com | In scope | 2026-11-14 |
| ldap.nextcloud.com | Not in the scope | 2026-11-14 |
| lists.nextcloud.com | In scope | 2026-11-14 |
| logs.nextcloud.commonitoring | In scope | 2026-11-14 |
| lookup.nextcloud.com | In scope | 2026-11-14 |
| accountwarning.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| aiosebastian.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| airtahiti.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| alexanderm.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| allied-world.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| alpes-controles.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| arulogic.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| awo-psychiatriezentrum.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| bastian.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| bates-white.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| bauhaus-dessau.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| bilgin.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| bitbw.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| chunimes.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
| cognizant.ltd.nextcloud.com | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.