Missing ownership check on remote wipe endpoint Analysed #819807 Valid Insecure Direct Object Reference High 2020-04-19 $500 141 Private circle can be added to another circle via API despite visibility restriction Analysed #3511998 Valid Insecure Direct Object Reference Low 2026-05-08 $150 87 WebAuthn app was updated based on public key Analysed #3360354 Valid Insecure Direct Object Reference Low 2026-02-06 – 84 TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot Analysed #3799010 Valid Insecure Direct Object Reference Medium 2026-08-14 – 73 Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner #3304830 Valid Insecure Direct Object Reference Low 2026-05-08 – 60 Calendar app allowed booking appointments without the generated token #3275810 Valid Insecure Direct Object Reference Low 2025-12-05 – 57 BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data #3382343 Informative Insecure Direct Object Reference Medium 2026-04-14 – 40 IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos #3518758 N/A Insecure Direct Object Reference – 2026-04-07 – 37 Ability to read any emails through IDOR on Nextcloud Mail #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 Share information of Tables app is not limited to affected users #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 Tables app allowed users to view columns metadata information of any table #3138721 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Missing ownership check in Tables app allows moving columns into tables of other users #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Enabling Birthday Contact to any user #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email #230328 Valid Insecure Direct Object Reference – 2017-09-16 – 29 Participants were able to blindly delete poll drafts of other users by ID #3247386 Valid Insecure Direct Object Reference Medium 2025-12-05 – 27 Possibility to delete files attached to deck cards of other users #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Access control missing while viewing the attachments in the "All boards" #916704 Valid Insecure Direct Object Reference Medium 2020-09-29 $150 20 Team membership information returned on API level based on ID #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Registered users can change app password permissions for any user #297751 Valid Insecure Direct Object Reference Low 2018-02-08 $100 18 Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board #1450117 Valid Insecure Direct Object Reference Medium 2022-05-20 – 13 Ownership check missing when updating or deleting attachments #1579820 Valid Insecure Direct Object Reference Medium 2022-07-06 – 7 New users can read all Nextcloud Deck data from previous user with same username #882258 Valid Insecure Direct Object Reference Low 2021-02-14 – 3