Skip to content
Sign in

Bug bounty program

NE

Nextcloud

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
94
Disclosed reports
613
Subdomains
1,642
Vendor on CyberSIXT
Nextcloud (399 CVEs, 0 exploited)

Most upvoted reports613

All reports
Most upvoted reports of Nextcloud
ReportWeaknessDisclosedBountyVotes
Code injection possible with malformed Nextcloud Talk chat commandsAnalysed#851807Command and Code Injection2020-06-02–317
User can delete data in shared folders he's not autorized to accessAnalysed#642515Access Control2020-04-10–173
Access to all files of remote user through shared fileAnalysed#258084Information Disclosure2020-03-01–154
Attacker can obtain write access to any federated share/public linkAnalysed#1170024Authentication2021-06-10$4,000142
Missing ownership check on remote wipe endpointAnalysed#819807Insecure Direct Object Reference2020-04-19$500141
Remote Code Execution via Extract App PluginAnalysed#546753Command and Code Injection2019-05-30–124
Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/#2946927No weakness recorded2025-03-16–113
Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope#3617729Information Disclosure2026-09-04$250101
PIN bypass in PassCodeActivity via back button#3625210Authentication2026-06-07$150101
Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)#3572848Access Control2026-05-21$150100

Subdomains1,642

Root:nextcloud.com
Scope
Name suggests:Mail
First seen
Text fileClear filters5 names
Subdomains of Nextcloud
NameScopeFirst seen
mx.nextcloud.commailNot in the scope2026-11-14
mail.nextcloud.commailNot in the scope2026-11-14
mail.ltd4.nextcloud.commailNot in the scope2026-11-14
mail2.ltd4.nextcloud.commailNot in the scope2026-11-14
exchange-test.ltd3.nextcloud.commail, testNot in the scope2026-11-14

23 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in