Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/ Analysed #2946927 Valid No weakness recorded Low 2025-03-16 – 113 User deletion is not handled properly everywhere Analysed #1200700 Valid No weakness recorded Medium 2021-07-15 $1,000 78 File-drop content is visible through the gallery app Analysed #719426 Valid No weakness recorded Medium 2020-01-31 – 68 Two-factor authentication enforcement bypass Analysed #1050244 Valid No weakness recorded High 2021-07-31 $750 64 Authentication bypass in Global Site Selector allows an attacker to log in as any user Analysed #2248689 Valid No weakness recorded Critical 2024-01-18 – 50 Mail stored HTML injection in subject text Analysed #3357036 Valid No weakness recorded Medium 2026-02-12 – 48 Unauthenticated SSRF via Public Reference API -Sharing Token Bypass #3479692 Informative No weakness recorded – 2026-03-31 – 41 tabnabbing in roundcube webmail Analysed #3367676 Valid No weakness recorded – 2025-12-24 – 37 I am because bug #226097 Spam No weakness recorded Critical 2017-05-04 – 32 Leak arbitrary file under nextcloud android client privacy directory Analysed #1142918 Valid No weakness recorded Medium 2021-07-17 – 25 https://help.nextcloud.com::: Web cache poisoning attack Analysed #429747 Valid No weakness recorded High 2020-01-31 – 25 Nextcloud Tables app - inserting rows to an arbitrary table possible Analysed #2671404 Valid No weakness recorded Medium 2024-11-17 – 24 Deck app allows to spoof file extensions by using RTLO characters Analysed #2326618 Valid No weakness recorded Medium 2026-01-04 $100 19 Server side request forgery (SSRF) on nextcloud implementation. #145524 Informative No weakness recorded – 2016-06-17 – 19 Clients do not verify server public key #1192470 Valid No weakness recorded Low 2021-09-23 $250 18 Ransomware protection is missing extentions take 2 #1200785 Valid No weakness recorded Low 2021-07-16 $100 17 public webdav endpoint not bruteforce protected #1192159 Valid No weakness recorded Low 2021-08-11 $100 17 Twitter Account hijack @nextcloudfrance #1916565 Valid No weakness recorded Medium 2023-03-30 – 15 Email Spoofing Vulnerability from nextcloud. #229599 Spam No weakness recorded High 2017-05-18 – 15 Android app does not clear end to end encryption keys #1189168 Valid No weakness recorded Low 2021-06-16 $100 14 End to end encryption public key is not properly verified on Desktop and Android #1189162 Valid No weakness recorded Medium 2021-09-23 $1,500 13 Only the file extensions are checked, not the MIME types as configured #697959 Valid No weakness recorded Medium 2020-03-14 – 13 Design Issues on ( ███ ) Lead to show ( IPS of Users ) #218733 Valid No weakness recorded Medium 2017-04-05 – 13 Wordpress 4.7.1 #201489 Valid No weakness recorded Low 2017-01-27 – 12 Add to your nextcloud endpoint is not properly protected #1192144 Valid No weakness recorded Low 2021-08-11 $100 11 User Editable nextcloud Wiki pages of Public Repositories #498878 Valid No weakness recorded High 2019-08-31 – 11 Wordpress Vulnerable to Potential Unauthorized Password Reset #226037 Valid No weakness recorded Low 2017-08-15 – 11 Admin audit is not properly logging unsetting of expiration date #1200810 Valid No weakness recorded Low 2021-07-15 – 10 Clickjacking URLS #1039805 Valid No weakness recorded – 2021-03-10 – 10 Group admin can remove user from all his groups via API #199286 Valid No weakness recorded None 2017-02-23 – 10 No rate limit while adding Additional emails feature #1913951 Valid No weakness recorded Low 2023-05-16 – 9 PHPUnit is included in groupfolders release package potentially causing RCE #820146 Valid No weakness recorded – 2020-06-25 – 9 user can bypass password enforcement when federated sharing is enabled #838510 Valid No weakness recorded – 2022-06-01 $250 8 Delete All Data of Any User #220385 Valid No weakness recorded Low 2020-03-01 – 8 Serverinfo endpoints are not bruteforce protected nor are tokens properly generated #1210458 Valid No weakness recorded Low 2021-06-16 – 7 Email Notification should be get while changing password on apps.nextcloud.com #308156 Informative No weakness recorded – 2018-02-28 – 7 A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora (Connectivity Software) on server (http://95.217.64.181:22 #1726445 Valid No weakness recorded Low 2022-12-10 – 6 Leaked of Profile Image from URL changing #1022211 Informative No weakness recorded – 2020-11-17 – 6 Malicious apps can crash Nextcloud Android client by sending malformed intents #859136 Valid No weakness recorded – 2021-06-17 – 6 Event privacy level does not work in Thunderbird #439828 Valid No weakness recorded Medium 2020-03-01 – 6 Missing SPF flags for customerupdates.nextcloud.com #385037 Valid No weakness recorded Medium 2020-03-01 – 6 Content spoofing due to the improper behavior of the 403 page #214340 Valid No weakness recorded – 2017-05-18 – 6 Talk discloses turn server to anybody #1195593 Informative No weakness recorded Low 2021-05-26 – 5 Version 4.7.2 of wordpress is vulnerable #211206 Valid No weakness recorded High 2017-03-07 – 5 Drone Nextcloud #198773 Informative No weakness recorded – 2017-02-12 – 5 Website PHP source code returned in javascript #1794462 Valid No weakness recorded Medium 2023-04-10 – 4 No admin audit entry for enabling/disabling 2FA #1200989 Informative No weakness recorded Low 2021-06-16 – 4 Nextcloud Server Remote Command Execution #226896 N/A No weakness recorded High 2017-05-10 – 4 No admin audit log for auth tokens #1200992 Informative No weakness recorded Low 2021-06-16 – 3 Ransomware protection is missing extentions #1195568 Valid No weakness recorded Low 2021-06-16 – 3