Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Clickjacking on https://nextcloud.com/#661768 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | – |
| [Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter#153251 | Valid | Misconfiguration and Insecure Design | – | 2016-12-05 | – | 1 |
| demo.nextcloud.com: Content spoofing due to default Apache Error Page#156425 | Valid | Misconfiguration and Insecure Design | – | 2016-08-30 | – | 1 |
| Content Injection - demo.nextcloud.com#161323 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 1 |
| Clickjacking on https://download.nextcloud.com#658011 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Clickjacking on https://download.nextcloud.com/#662155 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Nextcloud Clickjacking Vulnerability#710996 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Nextcloud server software: Content Spoofing#145463 | Valid | Misconfiguration and Insecure Design | – | 2016-07-19 | – | 2 |
| Content Injection 404 page#145849 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 2 |
| Content Injection in subdomain#145854 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 2 |
| Content spoofing in cloud.nextcloud.com#152925 | Valid | Misconfiguration and Insecure Design | – | 2016-08-30 | – | 2 |
| Content Injection - apps.nextcloud.com#161299 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 2 |
| Content Spoofing#145374 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers#145612 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| Content Spoofing/Text Injection - docs.nextcloud.org#145850 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| Content injection in subdomain#145853 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| demo.nextcloud.com: Content spoofing due to default Apache Error Page#155189 | Valid | Misconfiguration and Insecure Design | – | 2016-09-29 | – | 3 |
| **minor issue ** -Nextcloud 10.0 session issue with desktop client and android client#165353 | Valid | Misconfiguration and Insecure Design | – | 2020-03-01 | – | 3 |
| Login Hints on Admin Panel#188195 | Informative | Misconfiguration and Insecure Design | – | 2016-12-05 | – | 3 |
| Content (Text) Injection at https://nextcloud.com#222805 | Informative | Misconfiguration and Insecure Design | – | 2017-05-15 | – | 3 |
| Missing X-Content-Type-Options#369979 | Valid | Misconfiguration and Insecure Design | – | 2020-03-01 | – | 3 |
| stats.nextcloud.com: Content Injection#145375 | Valid | Misconfiguration and Insecure Design | – | 2016-07-17 | – | 4 |
| Content spoofing due to the improper behavior of the 403 page in Private Server#177335 | Valid | Misconfiguration and Insecure Design | – | 2016-10-31 | – | 4 |
| Content Spoofing in "files" app#179073 | Valid | Misconfiguration and Insecure Design | – | 2017-03-06 | $50 | 4 |
| Email Spoofing#200762 | Informative | Misconfiguration and Insecure Design | – | 2017-01-25 | – | 4 |
| Clickjacking In https://demo.nextcloud.com#222762 | N/A | Misconfiguration and Insecure Design | – | 2017-05-20 | – | 4 |
| nextcloud.com: Content Injection Custom 404 Error#145344 | Valid | Misconfiguration and Insecure Design | – | 2016-06-17 | – | 5 |
| More content spoofing through dir param in the files app#154827 | Valid | Misconfiguration and Insecure Design | – | 2016-11-04 | $50 | 5 |
| URI scheme bypass in mail app lead to HTML content spoof and opener control#175085 | Valid | Misconfiguration and Insecure Design | – | 2017-01-12 | – | 5 |
| HTTP-Basic Authentication on logs.nextcloud.com#198673 | Informative | Misconfiguration and Insecure Design | – | 2017-01-17 | – | 5 |
| Missing SPF Flags on nextcloud.com#205250 | Duplicate | Misconfiguration and Insecure Design | – | 2017-02-10 | – | 5 |
| Content spoofing due to the improper behavior of the 403 page#212770 | Valid | Misconfiguration and Insecure Design | – | 2017-05-18 | – | 5 |
| Missing Rate Limiting protection leading to mass triggering of e-mails#224927 | Valid | Misconfiguration and Insecure Design | – | 2017-06-05 | – | 5 |
| RTLO character allowed in shared files#229170 | Informative | Misconfiguration and Insecure Design | – | 2020-08-17 | – | 5 |
| Avatar image upload and bypass real image verification#145604 | Informative | Misconfiguration and Insecure Design | – | 2017-01-15 | – | 6 |
| Content Spoofing/Text Injection in nextcloud.com#213360 | Valid | Misconfiguration and Insecure Design | – | 2017-04-19 | – | 6 |
| Passcode Protection in Android Devices Can be Bypassed.#631206 | Informative | Misconfiguration and Insecure Design | – | 2019-08-27 | – | 6 |
| Ability to control the filename when uploading a logo or favicon on theming#1781751 | Valid | Misconfiguration and Insecure Design | Low | 2023-04-10 | – | 6 |
| Expired SSL certificate#163342 | Valid | Misconfiguration and Insecure Design | – | 2016-08-25 | – | 7 |
| Disabled user can reset their password#261297 | Valid | Misconfiguration and Insecure Design | – | 2020-03-01 | – | 7 |
| WordPress < 4.8.2 vulnerable to multiple attacks#269705 | Valid | Misconfiguration and Insecure Design | – | 2017-09-27 | – | 7 |
| Click Jacking Nextcloud#347782 | Informative | Misconfiguration and Insecure Design | – | 2019-07-01 | – | 7 |
| Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/#149798 | Valid | Misconfiguration and Insecure Design | – | 2016-12-02 | – | 8 |
| Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file#661051 | Valid | Misconfiguration and Insecure Design | – | 2020-11-05 | – | 9 |
| Content spoofing in lookup.nextcloud.com#171497 | Valid | Misconfiguration and Insecure Design | – | 2016-10-10 | – | 11 |
| Invalid request may lead content spoofing for phishing#213056 | Valid | Misconfiguration and Insecure Design | – | 2017-04-12 | – | 11 |
| WordPress vulnerable to multiple attacks at https://nextcloud.com#476526 | Valid | Misconfiguration and Insecure Design | – | 2020-03-01 | – | 11 |
| No Rate Limiting on stats.nextcloud.com login#146424 | Informative | Misconfiguration and Insecure Design | – | 2016-06-22 | – | 12 |
| Content Spoofing/Text Injection in https://demo.nextcloud.com#222058 | Valid | Misconfiguration and Insecure Design | – | 2017-04-28 | – | 13 |
| Content Spoofing /Text Injection in https://docs.nextcloud.com#666557 | Valid | Misconfiguration and Insecure Design | – | 2019-09-05 | – | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.