Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data#3382343	Informative	Insecure Direct Object Reference	Medium	2026-04-14	–	40
Read-only users can restore old versionsAnalysed#1356508	Valid	Access Control	Medium	2024-06-14	$500	38
files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account deletAnalysed#3770482	Valid	Access Control	Medium	2026-09-18	–	31
Non-admin users can reset app allowlist to the defaultAnalysed#2250398	Valid	Input Validation and Logic	Medium	2024-01-18	–	28
Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlistAnalysed#2251074	Valid	Injection and Smuggling	Medium	2024-01-18	–	22
Guests can continue to receive video streams from call after being removed from a conversationAnalysed#1706248	Valid	Information Disclosure	Medium	2022-12-31	–	15
Non-admin users can trigger writes to memcached by entering a malicious server as a share URLAnalysed#592864	Valid	Injection and Smuggling	Medium	2020-07-09	$100	15
Nextcloud 10.0 privilege escalation issue - Normal user can mask external storage shared by adminAnalysed#165229	Valid	Access Control	Medium	2020-03-01	–	14
Database resource exhaustion for logged-in users via sharee recommendations with circlesAnalysed#1688199	Valid	Denial of Service	Medium	2022-11-26	$250	13

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.