User can delete data in shared folders he's not autorized to access Analysed #642515 Valid Access Control Medium 2020-04-10 – 173 Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId) Analysed #3572848 Valid Access Control Medium 2026-05-21 $150 100 Re-Sharing allows increase of privileges Analysed #889243 Valid Access Control Medium 2020-09-28 – 92 View-only guests could see deleted Collectives pages in the trashbin Analysed #3521434 Valid Access Control Low 2026-05-08 – 87 ID4me feature of OpenID connect app available even when disabled Analysed #2376929 Valid Access Control Medium 2024-05-30 – 66 Valid share tokens allow to access tempory upload files of share owner Analysed #3483708 Valid Access Control Medium 2026-06-07 – 65 Arbitrary Board Preference Injection via Deck Config API Analysed #3599383 Valid Access Control Medium 2026-09-17 $200 62 Default Nextcloud Server and Android Client leak sharee searches to Nextcloud Analysed #1167916 Valid Access Control Low 2021-06-15 $750 58 Easy way to create a new Deck board without permission Analysed #2388183 Valid Access Control – 2026-01-16 $100 56 Download permissions can be changed by resharer Analysed #1724016 Valid Access Control Medium 2023-02-24 $500 49 Can download files on Android app without permission Analysed #2380133 Valid Access Control Low 2026-01-16 $250 47 Delete external storage of any user Analysed #2212627 Valid Access Control High 2023-11-21 – 45 User can copy locked folders and gain access to the contents #2447316 Valid Access Control Medium 2024-11-16 $500 44 Blind SSRF Vulnerability in Appstore Release Upload Form #2925666 Valid Access Control Low 2025-01-14 – 43 End-to-end encrypted file-drops can be made inaccessible #1914115 Valid Access Control High 2023-06-22 $400 43 Can download files by zipping the folder #2247457 Valid Access Control Medium 2024-02-17 – 41 Scoped apptokens can be changed by that very apptoken #1193321 Valid Access Control High 2021-07-15 $1,000 39 Deck app allowed user with "Can share" permission to modify permissions of other non-owners #3247499 Valid Access Control Medium 2025-12-05 – 38 Read-only users can restore old versions #1356508 Valid Access Control Medium 2024-06-14 $500 38 Expired reshare links allow access to all files in share #452854 Valid Access Control Critical 2019-06-27 – 38 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups #3674940 Valid Access Control Medium 2026-09-17 – 36 Can reshare read&share only folder with more permissions #2289425 Valid Access Control High 2024-07-14 $750 32 Bypass password confirmation via Context-dependent access control (CDCA) #2120667 Valid Access Control Medium 2024-01-17 $100 32 Group admins can remove arbitrary data from "data" directory (including admin data) #508493 Valid Access Control High 2019-08-12 – 32 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet #3770482 Valid Access Control Medium 2026-09-18 – 31 Admins can change authentication details of user configured external storage #2107934 Valid Access Control Low 2023-12-21 $100 31 Passcode bypass on Talk Android app #1784645 Valid Access Control Low 2023-01-09 – 30 Nextcloud mail does not respect download permissions in shares #1878255 Valid Access Control Low 2024-12-15 $250 29 Profile of disabled user stays accessible #1675014 Valid Access Control Low 2022-11-26 $100 27 Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4 #2290680 Valid Access Control Medium 2024-07-14 $500 24 Error in Booking an appointment reveals the full path of the website #1841408 Valid Access Control Low 2023-06-18 – 24 "Secure View" aka "Hide Download" can be bypassed easily #788257 Valid Access Control High 2020-04-10 – 22 Full Passcode bypass on Nextcloud App iOS #1847368 Valid Access Control Low 2023-04-10 – 21 Users can modify tags on files that do not belong to them #3040887 Valid Access Control Medium 2026-01-04 $150 20 Sensitive files/ data exists post deletion of user account #1222873 Valid Access Control Low 2022-05-20 – 20 Missing permission check when removing a photo from an album #1946298 Valid Access Control Low 2024-07-14 – 19 Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate #1596459 Valid Access Control Low 2022-12-25 – 19 see card comments after remove shared board #2289333 Valid Access Control Medium 2024-06-18 – 18 Disabled download shares still allow download through preview images #1745766 Valid Access Control Low 2022-12-31 – 18 FederationController::remoteWopiToken() returns full Wopi entity without token type validation #3568116 Valid Access Control Low 2026-10-27 – 17 Users can set up workflows using restricted and invisible system tags #1895976 Valid Access Control Medium 2023-05-17 – 17 Chat room member disclosure via autocomplete API #1850407 Valid Access Control Medium 2023-03-25 – 17 Missing rate limiting on password reset functionality allows to send lot of emails #1691195 Valid Access Control Low 2023-03-05 $100 17 User with read-only access to a share can gain write access to sub-folders in the share #619484 Valid Access Control Medium 2020-03-01 – 17 xmlrpc.php is enabled - Nextcloud #458696 Valid Access Control Medium 2020-03-01 – 17 Access control issue -- [Allow file system access not validated when using session auth] #388515 Valid Access Control Medium 2018-09-25 $100 17 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders #3506873 Valid Access Control Medium 2026-09-17 – 16 Missing server side controls when editing the board’s sharing permissions per user #827816 Valid Access Control High 2020-09-28 – 16 File drop public link can also be converted to federated share #1167929 Valid Access Control Low 2021-06-10 $500 15 Take over a mail account due missing validation of account id #1094063 Valid Access Control Medium 2021-06-01 – 15