Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Unauthenticated Persistent Denial-of-Service via Federated Share Injection#3679640	Valid	Denial of Service	High	2026-10-27	–	3
Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe#145396	Valid	Information Disclosure	–	2016-06-19	–	4
Unauthenticated 'display name' information leak on enumeration of login names#237232	Valid	Information Disclosure	–	2020-03-01	–	5
In Dockerized Environments, Failing to Read config.php Grants Any Anonymous User Full Admin Access#522876	Valid	Access Control	–	2019-07-27	–	11
Federated share accepting/declining is not logged in audit log#1200815	Valid	Input Validation and Logic	–	2022-09-03	–	12
Unauthenticated Stored xss#168054	N/A	Cross-site Scripting	–	2016-09-13	–	14
Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections#3303283	Valid	Server-Side Request Forgery	Medium	2026-09-17	–	15
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"#1595006	Valid	Server-Side Request Forgery	–	2022-09-03	$250	17
Unauthenticated testing endpoint of notify_push expose internal IP#3513471	Valid	Information Disclosure	Medium	2026-09-05	$150	38
Unauthenticated SSRF via Public Reference API -Sharing Token Bypass#3479692	Informative	No weakness recorded	–	2026-03-31	–	41

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.