Access to all files of remote user through shared file Analysed #258084 Valid Information Disclosure – 2020-03-01 – 154 Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope #3617729 Valid Information Disclosure Medium 2026-09-04 $250 101 Directory Listing of publicly available assets #2311179 Valid Information Disclosure Medium 2025-09-29 – 70 Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lock #331489 Valid Information Disclosure – 2019-07-26 – 58 SVG filter primitives bypass remote image blocking, enabling email tracking without consent. #3486747 Valid Information Disclosure Medium 2026-04-20 – 53 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 Events information leaked with shared calendars on recurrence exceptions #2479325 Valid Information Disclosure Low 2024-06-14 $100 45 Unauthenticated testing endpoint of notify_push expose internal IP #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 Email Enumeration via Password-Protected Share Identity Verification #3507273 Valid Information Disclosure Low 2026-09-05 $100 35 Mail auto configurator can be tricked into sending account information to wrong servers #2508422 Valid Information Disclosure High 2024-11-15 $100 34 Incomplete sanitization in SVG preview provider #2484499 Valid Information Disclosure Medium 2024-12-15 $250 34 Possible to enumerate valid files in password protected shares/files drop shares as well as spam folder with files #2376909 Valid Information Disclosure Low 2025-02-21 – 29 Attachments folder for Text app is accessible on Files Drop/Password protected shares #2376900 Valid Information Disclosure Low 2024-11-15 – 29 Database error shown to the user when using a long guest name in richdocuments #1067824 Valid Information Disclosure – 2021-02-07 – 29 External storage - global credentials returned to the client side in plaintext #2554079 Valid Information Disclosure Medium 2024-11-21 – 28 Cards in Deck are readable by any user #1331728 Valid Information Disclosure – 2023-03-26 – 25 Bypass of privacy filter / tracking pixel blocker #1215251 Valid Information Disclosure – 2021-08-11 $100 24 Notification implicit PendingIntent in com.nextcloud.client allows to access contacts #1161401 Valid Information Disclosure – 2022-05-27 $250 21 Folder architecture and Filesizes of private file drop shares can be getten #1337422 Valid Information Disclosure – 2022-04-09 – 18 Error when editing a calendar appointment returns stacktrace and query #2108342 Valid Information Disclosure Medium 2024-01-17 – 16 Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log] #1767439 Valid Information Disclosure Low 2022-12-15 – 16 HEIC image preview can be used to invoke Imagick #1261413 Valid Information Disclosure – 2023-01-07 – 16 Android - Possible to intercept broadcasts about uploaded files #167481 Valid Information Disclosure – 2017-03-23 – 16 Messages can still be seen on conversation after expiring when cron is misconfigured #1784310 Valid Information Disclosure Low 2023-02-27 – 15 Guests can continue to receive video streams from call after being removed from a conversation #1706248 Valid Information Disclosure – 2022-12-31 – 15 Exposing debug.log file leads to server full path disclosure #696360 Valid Information Disclosure – 2019-10-17 – 15 Reference caching can leak data to unauthorized users #1767503 Valid Information Disclosure Medium 2023-01-13 – 14 Nextcloud domain and name of every user leaked to lookup server #508490 Valid Information Disclosure – 2019-11-26 – 14 Talk / spreed: Disclosure of Room names and participants for password protected rooms #428010 Valid Information Disclosure – 2019-04-17 $50 13 Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API #3524971 Valid Information Disclosure Low 2026-10-27 – 12 Information exposure in in guzzlehttp/guzzle (https://github.com/nextcloud/3rdparty/tree/master/guzzlehttp/guzzle) #1604606 Valid Information Disclosure – 2022-09-16 – 12 Lack of Brute force protection while joining video call in talk section which is password protected #1596673 Valid Information Disclosure – 2022-08-08 – 12 https://portal.nextcloud.com/.htaccess file is readable #220946 Valid Information Disclosure – 2017-04-14 – 12 Disclosure of administrators via JSON on nextcloud.com Wordpress #198012 Valid Information Disclosure – 2017-01-13 – 12 Default settings leak federated cloud id to lookup server of all users #1173436 Valid Information Disclosure – 2021-06-10 $350 11 The session token in the URL #341372 Informative Information Disclosure – 2018-06-19 – 11 Last video frame is still sent after video is disabled in a call #1641088 Valid Information Disclosure – 2022-09-16 – 10 GIT Detected #221298 Valid Information Disclosure – 2017-04-20 – 10 bug reporting template encourages users to paste config file with passwords #196878 Valid Information Disclosure – 2017-04-19 – 10 Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic #1520685 Valid Information Disclosure – 2022-06-09 $100 9 User files is disclosed when someone called while the screen is locked #1338781 Valid Information Disclosure – 2022-03-14 – 9 Files Drop: WebDAV endpoint is leaking existence of resources #187460 Valid Information Disclosure – 2017-01-01 – 9 help.nextcloud Email Address/Username enumeration #145734 Informative Information Disclosure – 2016-06-19 – 9 Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory #3159877 Valid Information Disclosure None 2026-01-04 – 8 Directory listing is enabled that exposes non public data through multiple path #690796 Valid Information Disclosure – 2020-02-01 – 8 Wordpress Users Disclosure #625199 Duplicate Information Disclosure – 2019-07-01 – 8 User Information Disclosure via REST API #197877 Valid Information Disclosure – 2017-02-11 – 8 Private/confidential setting of calendar events is ignored on activity stream #476615 Valid Information Disclosure – 2019-06-27 – 7 Android content provider exposes password-protected share password hashes #242727 Valid Information Disclosure – 2020-01-31 $75 7 Calendar and addressbook names disclosed (NC-SA-2017-012) #203594 Valid Information Disclosure – 2017-05-08 $183 7