Ubuntu 12.04 Privilege Escalation #380782 Informative Access Control – 2018-12-18 – – The email API to test email-server settings is unlimited and can be used as a email bomb #222660 Informative Access Control Medium 2017-04-24 – 2 Trusted server shared secret stored unencrypted in the database #1173670 Informative Access Control Low 2021-06-16 – 2 No password confirmation required when using apptoken on sensitive endpoint #3566607 Valid Access Control Medium 2026-10-27 – 2 Github repo's wiki publicly editable #475114 Valid Access Control – 2020-01-31 – 3 Bypassing Passcode/Device credentials #747726 Valid Access Control – 2021-01-15 – 3 Bookmarks: Delete all existing bookmarks of a user #154529 Valid Access Control – 2016-08-08 – 4 Bypassing quota limit #173622 Valid Access Control – 2017-03-10 – 4 The email API to reset password is unlimited and can be used as a email bomb #222080 Duplicate Access Control Low 2017-04-20 – 4 Files Confidential tagging can be bypassed with # in filename #3682163 Valid Access Control Medium 2026-10-27 – 4 Business/Functional logic bypass: Remove admins from admin group. #145745 Informative Access Control – 2016-06-19 – 5 Dav sharing permissions issue #174896 Valid Access Control – 2017-05-20 – 5 Limitation of app specific password scope can be bypassed (NC-SA-2017-009) #191979 Valid Access Control Low 2017-05-08 $300 5 Circle email-members have still access to a shared folder/file after they are removed from the circle #673724 Valid Access Control Low 2020-03-01 $200 5 [nextcloud.com] Control character allowed in Submit Question #1081211 Valid Access Control Medium 2021-01-20 – 5 Create alias does not validate account id #1129996 Valid Access Control Medium 2021-06-01 – 5 bypassing dashboard without account + Information disclosure trough websockets #1102780 Informative Access Control High 2021-04-20 – 6 Public shares remain accessible via alternate endpoints after owner account is disabled #3620539 Valid Access Control Medium 2026-10-27 $270 6 Tables application does not respect sharing limitations set by admin #3642236 Valid Access Control Medium 2026-10-27 – 6 Improper protection of FileContentProvider #331302 Valid Access Control Low 2020-03-01 – 7 File access control rules not enforced on image files #358339 Valid Access Control Low 2018-06-15 – 7 The password of a mail share is not set if the password is given when the share is created (Nextcloud < 18) #888261 Valid Access Control Low 2021-03-04 – 7 Github wikis are editable by anyone https://github.com/nextcloud/bookmarks/wiki #906322 Valid Access Control – 2021-01-15 – 7 Unexpected federated shares added via public link #1167767 Informative Access Control Medium 2021-04-26 – 7 Default Nextcloud server config and iOS Nextcloud client leak sharee searches to Nextcloud #1167919 Valid Access Control Low 2021-05-31 – 7 IDOR - Disable sharing #153905 Valid Access Control – 2016-12-03 – 8 Github wikis are editable by anyone #457032 Valid Access Control Medium 2018-12-07 – 8 Improper access control to messages of Social app #921717 Valid Access Control Medium 2020-11-17 – 8 Acting under any different user via DB-stored credentials #1061591 Valid Access Control High 2021-03-01 – 8 Federated editing allows iframing possibly malicious remotes #1210424 Valid Access Control Low 2022-07-02 $100 8 Privilege escalation - Normal user can somehow make admin to delete shared folders #166581 Valid Access Control – 2017-05-20 – 9 Bypass permissions #169680 Valid Access Control – 2017-02-09 – 9 Share recipient can modify a share's expiration date #447494 Valid Access Control Medium 2020-01-31 $100 9 Allows any user to share their "Root" level folder by sharing "." #889795 Valid Access Control None 2020-06-03 – 9 Nextcloud deck sharee search leaks searches to lookupserver by default #1167958 Valid Access Control Low 2021-05-26 – 9 Webauthn tokens are not removed on user deletion #1202590 Valid Access Control Medium 2021-08-07 – 9 Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone #3511955 Valid Access Control Medium 2026-10-27 – 9 Public collectives allow to create pages #3533697 Valid Access Control Low 2026-09-17 – 9 End to end encryption folder locking is not properly protected #1189174 Valid Access Control Low 2021-06-10 $250 10 Document content of files can be obtained through Collabora for files of other users #1788222 Valid Access Control Medium 2023-05-04 – 10 In Dockerized Environments, Failing to Read config.php Grants Any Anonymous User Full Admin Access #522876 Valid Access Control High 2019-07-27 – 11 Update App Store: Django account high jacking vulnerability #761329 Valid Access Control Medium 2020-01-31 – 11 com.nextcloud.client bypass the protection lock in andoid app v 3.18.1 latest version. #1450368 Valid Access Control Low 2022-04-30 $200 11 Hide download previews are accessible without a watermark #1745755 Valid Access Control Low 2023-05-04 – 11 New AppPassword can be generated without password confirmation #2067572 Valid Access Control High 2023-08-10 $250 11 Unauthorised access with hidden public link creation when sharing to a Team External Member #3625932 Valid Access Control Low 2026-10-27 $100 11 Able to bypass "Device credentials" Lock #507172 Valid Access Control Low 2019-07-26 – 12 Trusted servers exchange can be triggered by attacker #1167853 Valid Access Control Medium 2021-06-10 $750 12 Text does not respect 'Allow download' permissions #1965156 Valid Access Control Low 2023-08-23 $250 12 Secure view trivial to bypass #1724021 Valid Access Control Medium 2023-03-30 $150 13