Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF protection on OIDC login is brokenAnalysed#1878381 | Valid | Cross-Site Request Forgery | Medium | 2023-04-04 | $500 | 77 |
| CSRF vulnerability that allows an attacker to modify encryption settingsAnalysed#630146 | Valid | Cross-Site Request Forgery | Low | 2019-12-07 | – | 27 |
| CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious linkAnalysed#1741430 | Valid | Cross-Site Request Forgery | Medium | 2023-01-11 | – | 25 |
| Possibility to force an admin to install recommended applications#1403614 | Valid | Cross-Site Request Forgery | Low | 2022-04-29 | $100 | 10 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.