No rate limiting for confirmation email lead to huge Mass mailings Analysed #997070 Valid Input Validation and Logic Medium 2020-11-04 – 82 Improper input validation in emoji field leads to sidebar UI denial of service Analysed #3599470 Valid Input Validation and Logic Low 2026-09-20 – 64 Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes Analysed #3610332 Valid Input Validation and Logic Medium 2026-09-17 $150 63 Notes app can be tricked into using a received share created before the user logged in Analysed #2254151 Valid Input Validation and Logic Medium 2024-06-19 – 49 Exposing debug.log file leads to server full path disclosure Analysed #2778441 Valid Input Validation and Logic Medium 2025-09-29 – 47 Non-admin users can reset app allowlist to the default Analysed #2250398 Valid Input Validation and Logic Medium 2024-01-18 – 28 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables Analysed #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 Unrestricted file upload on the image of contacts Analysed #808287 Valid Input Validation and Logic Low 2020-07-08 $100 24 User scoped external storage can be used to gather credentials of other users Analysed #1978882 Valid Input Validation and Logic High 2023-06-27 – 23 Calendar attachments of local files are offered to downloaded Analysed #3112033 Valid Input Validation and Logic Medium 2025-12-05 – 22 Gallery: No feedback for invalid password Analysed #428660 Valid Input Validation and Logic Low 2019-07-27 $50 22 Deck app: Invalid tag color is accepted by API and breaks frontend UI Analysed #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Missing Duplicate Check allowing Multiple Retention Rules per System Tag Analysed #3521646 Valid Input Validation and Logic Low 2026-09-05 – 20 When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL #1358977 Valid Input Validation and Logic Medium 2022-02-15 – 19 No rate limiting on sinup page #922470 Valid Input Validation and Logic Low 2020-09-28 – 16 bypass forced password protection via circles app #1406926 Valid Input Validation and Logic Low 2022-06-19 $100 14 Federated share accepting/declining is not logged in audit log #1200815 Valid Input Validation and Logic Low 2022-09-03 – 12 objectId in share location can be set to open arbitrary URL or Deeplinks #1337178 Valid Input Validation and Logic Medium 2022-03-08 – 8 Name collision of shared folders #1697281 Valid Input Validation and Logic Medium 2023-04-29 – 5