Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Privilege escalation - Normal user can somehow make admin to delete shared folders#166581	Valid	Access Control	–	2017-05-20	–	9
Database resource exhaustion for logged-in users via sharee recommendations with circles#1688199	Valid	Denial of Service	Medium	2022-11-26	$250	13
Nextcloud 10.0 privilege escalation issue - Normal user can mask external storage shared by admin#165229	Valid	Access Control	–	2020-03-01	–	14
Blind SSRF as normal user from mailapp#1913095	Valid	Server-Side Request Forgery	Low	2023-05-30	–	14
Non-admin users can trigger writes to memcached by entering a malicious server as a share URL#592864	Valid	Injection and Smuggling	Medium	2020-07-09	$100	15
Guests can continue to receive video streams from call after being removed from a conversation#1706248	Valid	Information Disclosure	Medium	2022-12-31	–	15
Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist#2251074	Valid	Injection and Smuggling	Medium	2024-01-18	–	22
Non-admin users can reset app allowlist to the default#2250398	Valid	Input Validation and Logic	Medium	2024-01-18	–	28
files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet#3770482	Valid	Access Control	Medium	2026-09-18	–	31
Read-only users can restore old versions#1356508	Valid	Access Control	Medium	2024-06-14	$500	38
BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data#3382343	Informative	Insecure Direct Object Reference	Medium	2026-04-14	–	40
View-only guests could see deleted Collectives pages in the trashbinAnalysed#3521434	Valid	Access Control	Low	2026-05-08	–	87

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,199 analysed so far), which can be wrong. Data as of 2026-11-14.