User can delete data in shared folders he's not autorized to access Analysed #642515 Valid Access Control Medium 2020-04-10 – 173 Re-Sharing allows increase of privileges Analysed #889243 Valid Access Control Medium 2020-09-28 – 92 View-only guests could see deleted Collectives pages in the trashbin Analysed #3521434 Valid Access Control Low 2026-05-08 – 87 Valid share tokens allow to access tempory upload files of share owner Analysed #3483708 Valid Access Control Medium 2026-06-07 – 65 Arbitrary Board Preference Injection via Deck Config API Analysed #3599383 Valid Access Control Medium 2026-09-17 $200 62 Default Nextcloud Server and Android Client leak sharee searches to Nextcloud Analysed #1167916 Valid Access Control Low 2021-06-15 $750 58 Easy way to create a new Deck board without permission Analysed #2388183 Valid Access Control – 2026-01-16 $100 56 Download permissions can be changed by resharer Analysed #1724016 Valid Access Control Medium 2023-02-24 $500 49 Can download files on Android app without permission Analysed #2380133 Valid Access Control Low 2026-01-16 $250 47 Delete external storage of any user Analysed #2212627 Valid Access Control High 2023-11-21 – 45 End-to-end encrypted file-drops can be made inaccessible Analysed #1914115 Valid Access Control High 2023-06-22 $400 43 Can download files by zipping the folder Analysed #2247457 Valid Access Control Medium 2024-02-17 – 41 Scoped apptokens can be changed by that very apptoken Analysed #1193321 Valid Access Control High 2021-07-15 $1,000 39 Deck app allowed user with "Can share" permission to modify permissions of other non-owners Analysed #3247499 Valid Access Control Medium 2025-12-05 – 38 Read-only users can restore old versions Analysed #1356508 Valid Access Control Medium 2024-06-14 $500 38 Expired reshare links allow access to all files in share Analysed #452854 Valid Access Control Critical 2019-06-27 – 38 Bypass password confirmation via Context-dependent access control (CDCA) Analysed #2120667 Valid Access Control Medium 2024-01-17 $100 32 Group admins can remove arbitrary data from "data" directory (including admin data) Analysed #508493 Valid Access Control High 2019-08-12 – 32 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet Analysed #3770482 Valid Access Control Medium 2026-09-18 – 31 Sensitive files/ data exists post deletion of user account Analysed #1222873 Valid Access Control Low 2022-05-20 – 20 Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate Analysed #1596459 Valid Access Control Low 2022-12-25 – 19 Disabled download shares still allow download through preview images Analysed #1745766 Valid Access Control Low 2022-12-31 – 18 Chat room member disclosure via autocomplete API Analysed #1850407 Valid Access Control Medium 2023-03-25 – 17 User with read-only access to a share can gain write access to sub-folders in the share Analysed #619484 Valid Access Control Medium 2020-03-01 – 17 Access control issue -- [Allow file system access not validated when using session auth] Analysed #388515 Valid Access Control Medium 2018-09-25 $100 17 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders Analysed #3506873 Valid Access Control Medium 2026-09-17 – 16 Missing server side controls when editing the board’s sharing permissions per user Analysed #827816 Valid Access Control High 2020-09-28 – 16