Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| OAuth2 "authorization_code" is valid indefinetlyAnalysed#1784162 | Valid | Misconfiguration and Insecure Design | Low | 2024-02-17 | $100 | 45 |
| Email not verified when changing afterwards on apps.nextcloud.comAnalysed#2305880 | Valid | Misconfiguration and Insecure Design | Low | 2025-09-29 | – | 42 |
| No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deletedAnalysed#194329 | Valid | Misconfiguration and Insecure Design | – | 2020-02-09 | – | 35 |
| Username and Access Token DisclousureAnalysed#672623 | Valid | Misconfiguration and Insecure Design | Low | 2020-03-01 | $250 | 20 |
| Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11#145392 | Valid | Misconfiguration and Insecure Design | – | 2016-08-17 | – | 18 |
| Suspicious login app ships old league/flysystem version#1720822 | Valid | Misconfiguration and Insecure Design | – | 2023-02-08 | – | 17 |
| Content Spoofing /Text Injection in https://docs.nextcloud.com#666557 | Valid | Misconfiguration and Insecure Design | Low | 2019-09-05 | – | 14 |
| Content Spoofing/Text Injection in https://demo.nextcloud.com#222058 | Valid | Misconfiguration and Insecure Design | Low | 2017-04-28 | – | 13 |
| WordPress vulnerable to multiple attacks at https://nextcloud.com#476526 | Valid | Misconfiguration and Insecure Design | Medium | 2020-03-01 | – | 11 |
| Invalid request may lead content spoofing for phishing#213056 | Valid | Misconfiguration and Insecure Design | – | 2017-04-12 | – | 11 |
| Content spoofing in lookup.nextcloud.com#171497 | Valid | Misconfiguration and Insecure Design | Low | 2016-10-10 | – | 11 |
| Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file#661051 | Valid | Misconfiguration and Insecure Design | Low | 2020-11-05 | – | 9 |
| Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/#149798 | Valid | Misconfiguration and Insecure Design | Low | 2016-12-02 | – | 8 |
| WordPress < 4.8.2 vulnerable to multiple attacks#269705 | Valid | Misconfiguration and Insecure Design | Low | 2017-09-27 | – | 7 |
| Disabled user can reset their password#261297 | Valid | Misconfiguration and Insecure Design | None | 2020-03-01 | – | 7 |
| Expired SSL certificate#163342 | Valid | Misconfiguration and Insecure Design | – | 2016-08-25 | – | 7 |
| Ability to control the filename when uploading a logo or favicon on theming#1781751 | Valid | Misconfiguration and Insecure Design | Low | 2023-04-10 | – | 6 |
| Content Spoofing/Text Injection in nextcloud.com#213360 | Valid | Misconfiguration and Insecure Design | Low | 2017-04-19 | – | 6 |
| Missing Rate Limiting protection leading to mass triggering of e-mails#224927 | Valid | Misconfiguration and Insecure Design | Medium | 2017-06-05 | – | 5 |
| Content spoofing due to the improper behavior of the 403 page#212770 | Valid | Misconfiguration and Insecure Design | – | 2017-05-18 | – | 5 |
| URI scheme bypass in mail app lead to HTML content spoof and opener control#175085 | Valid | Misconfiguration and Insecure Design | – | 2017-01-12 | – | 5 |
| More content spoofing through dir param in the files app#154827 | Valid | Misconfiguration and Insecure Design | Low | 2016-11-04 | $50 | 5 |
| nextcloud.com: Content Injection Custom 404 Error#145344 | Valid | Misconfiguration and Insecure Design | – | 2016-06-17 | – | 5 |
| Content Spoofing in "files" app#179073 | Valid | Misconfiguration and Insecure Design | Low | 2017-03-06 | $50 | 4 |
| Content spoofing due to the improper behavior of the 403 page in Private Server#177335 | Valid | Misconfiguration and Insecure Design | None | 2016-10-31 | – | 4 |
| stats.nextcloud.com: Content Injection#145375 | Valid | Misconfiguration and Insecure Design | – | 2016-07-17 | – | 4 |
| Missing X-Content-Type-Options#369979 | Valid | Misconfiguration and Insecure Design | – | 2020-03-01 | – | 3 |
| **minor issue ** -Nextcloud 10.0 session issue with desktop client and android client#165353 | Valid | Misconfiguration and Insecure Design | Medium | 2020-03-01 | – | 3 |
| demo.nextcloud.com: Content spoofing due to default Apache Error Page#155189 | Valid | Misconfiguration and Insecure Design | – | 2016-09-29 | – | 3 |
| Content injection in subdomain#145853 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| Content Spoofing/Text Injection - docs.nextcloud.org#145850 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers#145612 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| Content Spoofing#145374 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| Content Injection - apps.nextcloud.com#161299 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 2 |
| Content spoofing in cloud.nextcloud.com#152925 | Valid | Misconfiguration and Insecure Design | – | 2016-08-30 | – | 2 |
| Content Injection in subdomain#145854 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 2 |
| Content Injection 404 page#145849 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 2 |
| Nextcloud server software: Content Spoofing#145463 | Valid | Misconfiguration and Insecure Design | – | 2016-07-19 | – | 2 |
| Content Injection - demo.nextcloud.com#161323 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 1 |
| demo.nextcloud.com: Content spoofing due to default Apache Error Page#156425 | Valid | Misconfiguration and Insecure Design | – | 2016-08-30 | – | 1 |
| [Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter#153251 | Valid | Misconfiguration and Insecure Design | – | 2016-12-05 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.