Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
User can copy locked folders and gain access to the contentsAnalysed#2447316	Valid	Access Control	Medium	2024-11-16	$500	44
Blind SSRF Vulnerability in Appstore Release Upload FormAnalysed#2925666	Valid	Access Control	Low	2025-01-14	–	43
Can reshare read&share only folder with more permissionsAnalysed#2289425	Valid	Access Control	High	2024-07-14	$750	32
Nextcloud mail does not respect download permissions in sharesAnalysed#1878255	Valid	Access Control	Low	2024-12-15	$250	29
Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4Analysed#2290680	Valid	Access Control	Medium	2024-07-14	$500	24
Full Passcode bypass on Nextcloud App iOSAnalysed#1847368	Valid	Access Control	Low	2023-04-10	–	21
Users can modify tags on files that do not belong to themAnalysed#3040887	Valid	Access Control	Medium	2026-01-04	$150	20
Missing permission check when removing a photo from an albumAnalysed#1946298	Valid	Access Control	Low	2024-07-14	–	19
see card comments after remove shared boardAnalysed#2289333	Valid	Access Control	Medium	2024-06-18	–	18
Users can set up workflows using restricted and invisible system tagsAnalysed#1895976	Valid	Access Control	Medium	2023-05-17	–	17

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.