Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Lost Password CSRF#145583 | Informative | Cross-Site Request Forgery | – | 2016-06-19 | – | 2 |
| CSRF token validation is missing#221043 | Informative | Cross-Site Request Forgery | – | 2017-04-19 | – | 2 |
| Vulnerable W3 Total Cache plugin version in use on nextcloud.com#579116 | Informative | Cross-Site Request Forgery | – | 2019-06-21 | – | 5 |
| Possibility to force an admin to install recommended applications#1403614 | Valid | Cross-Site Request Forgery | – | 2022-04-29 | $100 | 10 |
| CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link#1741430 | Valid | Cross-Site Request Forgery | – | 2023-01-11 | – | 25 |
| CSRF vulnerability that allows an attacker to modify encryption settings#630146 | Valid | Cross-Site Request Forgery | – | 2019-12-07 | – | 27 |
| CSRF protection on OIDC login is broken#1878381 | Valid | Cross-Site Request Forgery | – | 2023-04-04 | $500 | 77 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.