New users can read all Nextcloud Deck data from previous user with same username #882258 Valid Insecure Direct Object Reference Low 2021-02-14 – 3 Ownership check missing when updating or deleting attachments #1579820 Valid Insecure Direct Object Reference Medium 2022-07-06 – 7 Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board #1450117 Valid Insecure Direct Object Reference Medium 2022-05-20 – 13 Registered users can change app password permissions for any user #297751 Valid Insecure Direct Object Reference – 2018-02-08 $100 18 Team membership information returned on API level based on ID #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Access control missing while viewing the attachments in the "All boards" #916704 Valid Insecure Direct Object Reference Medium 2020-09-29 $150 20 Possibility to delete files attached to deck cards of other users #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Participants were able to blindly delete poll drafts of other users by ID #3247386 Valid Insecure Direct Object Reference Medium 2025-12-05 – 27 IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email #230328 Valid Insecure Direct Object Reference – 2017-09-16 – 29 Enabling Birthday Contact to any user #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 Missing ownership check in Tables app allows moving columns into tables of other users #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Tables app allowed users to view columns metadata information of any table #3138721 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Share information of Tables app is not limited to affected users #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 Ability to read any emails through IDOR on Nextcloud Mail #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos #3518758 N/A Insecure Direct Object Reference – 2026-04-07 – 37 BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data #3382343 Informative Insecure Direct Object Reference Medium 2026-04-14 – 40 Calendar app allowed booking appointments without the generated token #3275810 Valid Insecure Direct Object Reference Low 2025-12-05 – 57 Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner #3304830 Valid Insecure Direct Object Reference Low 2026-05-08 – 60 TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot #3799010 Valid Insecure Direct Object Reference Medium 2026-08-14 – 73 WebAuthn app was updated based on public key Analysed #3360354 Valid Insecure Direct Object Reference Low 2026-02-06 – 84 Private circle can be added to another circle via API despite visibility restriction Analysed #3511998 Valid Insecure Direct Object Reference Low 2026-05-08 $150 87 Missing ownership check on remote wipe endpoint Analysed #819807 Valid Insecure Direct Object Reference – 2020-04-19 $500 141