Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Unauthenticated SSRF via Public Reference API -Sharing Token Bypass#3479692	Informative	No weakness recorded	–	2026-03-31	–	41
Unauthenticated testing endpoint of notify_push expose internal IP#3513471	Valid	Information Disclosure	Medium	2026-09-05	$150	38
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"#1595006	Valid	Server-Side Request Forgery	–	2022-09-03	$250	17
Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections#3303283	Valid	Server-Side Request Forgery	Medium	2026-09-17	–	15
Unauthenticated Stored xss#168054	N/A	Cross-site Scripting	–	2016-09-13	–	14
Federated share accepting/declining is not logged in audit log#1200815	Valid	Input Validation and Logic	–	2022-09-03	–	12
In Dockerized Environments, Failing to Read config.php Grants Any Anonymous User Full Admin Access#522876	Valid	Access Control	–	2019-07-27	–	11
Unauthenticated 'display name' information leak on enumeration of login names#237232	Valid	Information Disclosure	–	2020-03-01	–	5
Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe#145396	Valid	Information Disclosure	–	2016-06-19	–	4
Unauthenticated Persistent Denial-of-Service via Federated Share Injection#3679640	Valid	Denial of Service	High	2026-10-27	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.