Bypass hide download Nextcloud Share #865777 Informative Input Validation and Logic – 2020-10-05 – 1 SignUp using Fake Email #664200 Informative Input Validation and Logic – 2019-08-02 – 4 Name collision of shared folders #1697281 Valid Input Validation and Logic – 2023-04-29 – 5 Email Spoofing #793532 Duplicate Input Validation and Logic – 2020-02-20 – 6 Targeted phishing attacks in Login flow v2 #1169033 Informative Input Validation and Logic – 2023-03-03 – 6 objectId in share location can be set to open arbitrary URL or Deeplinks #1337178 Valid Input Validation and Logic – 2022-03-08 – 8 Federated share accepting/declining is not logged in audit log #1200815 Valid Input Validation and Logic – 2022-09-03 – 12 bypass forced password protection via circles app #1406926 Valid Input Validation and Logic – 2022-06-19 $100 14 No rate limiting on sinup page #922470 Valid Input Validation and Logic – 2020-09-28 – 16 When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL #1358977 Valid Input Validation and Logic – 2022-02-15 – 19 Missing Duplicate Check allowing Multiple Retention Rules per System Tag #3521646 Valid Input Validation and Logic Low 2026-09-05 – 20 Deck app: Invalid tag color is accepted by API and breaks frontend UI #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Gallery: No feedback for invalid password #428660 Valid Input Validation and Logic – 2019-07-27 $50 22 Calendar attachments of local files are offered to downloaded #3112033 Valid Input Validation and Logic Medium 2025-12-05 – 22 User scoped external storage can be used to gather credentials of other users #1978882 Valid Input Validation and Logic High 2023-06-27 – 23 Unrestricted file upload on the image of contacts #808287 Valid Input Validation and Logic – 2020-07-08 $100 24 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 Non-admin users can reset app allowlist to the default #2250398 Valid Input Validation and Logic Medium 2024-01-18 – 28 Exposing debug.log file leads to server full path disclosure #2778441 Valid Input Validation and Logic Medium 2025-09-29 – 47 Notes app can be tricked into using a received share created before the user logged in #2254151 Valid Input Validation and Logic Medium 2024-06-19 – 49 Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes #3610332 Valid Input Validation and Logic Medium 2026-09-17 $150 63 Improper input validation in emoji field leads to sidebar UI denial of service #3599470 Valid Input Validation and Logic Low 2026-09-20 – 64 No rate limiting for confirmation email lead to huge Mass mailings #997070 Valid Input Validation and Logic – 2020-11-04 – 82