Session fixation on public talk links #1181962 Valid Authentication Medium 2021-06-16 $100 23 Improper restriction of excessive authentication attempts on WebDAV endpoint #1924212 Valid Authentication Medium 2023-08-10 – 23 User scoped external storage can be used to gather credentials of other users #1978882 Valid Input Validation and Logic High 2023-06-27 – 23 Cross-User Lock/Unlock via Absolute DAV Path #3301553 Valid Authentication Medium 2026-09-17 – 23 Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app #3521639 Valid Memory Corruption Low 2026-09-05 – 23 SMTP header injection via C-escape `\r` in the recipient display name #3913007 Valid Memory Corruption None 2026-10-18 – 23 Stored XSS on Share-popup of a directory's Gallery-view #145355 Valid Cross-site Scripting – 2016-07-19 – 24 Unrestricted file upload on the image of contacts #808287 Valid Input Validation and Logic Low 2020-07-08 $100 24 Bypass of privacy filter / tracking pixel blocker #1215251 Valid Information Disclosure Medium 2021-08-11 $100 24 Error in Booking an appointment reveals the full path of the website #1841408 Valid Access Control Low 2023-06-18 – 24 Missing brute force protection on password confirmation modal #1842114 Valid Authentication Medium 2023-03-21 – 24 Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4 #2290680 Valid Access Control Medium 2024-07-14 $500 24 Nextcloud Tables app - inserting rows to an arbitrary table possible #2671404 Valid No weakness recorded Medium 2024-11-17 – 24 https://help.nextcloud.com::: Web cache poisoning attack #429747 Valid No weakness recorded High 2020-01-31 – 25 Leak arbitrary file under nextcloud android client privacy directory #1142918 Valid No weakness recorded Medium 2021-07-17 – 25 Cards in Deck are readable by any user #1331728 Valid Information Disclosure Medium 2023-03-26 – 25 CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link #1741430 Valid Cross-Site Request Forgery Medium 2023-01-11 – 25 Event create can create attachments that link to other websites #2457588 Valid Open Redirect Medium 2024-07-14 $250 25 [nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed #2902856 Informative Server-Side Request Forgery Medium 2025-12-23 – 25 Predictable proposal participant tokens enable unauthorized access and vote submission #3385434 Valid Cryptography Low 2026-01-04 $100 25 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 XSS in PDF Viewer #819863 Valid Cross-site Scripting Low 2020-05-23 $100 26 SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent #3590576 Valid File and Path Handling Medium 2026-04-20 – 26 CSRF vulnerability that allows an attacker to modify encryption settings #630146 Valid Cross-Site Request Forgery Low 2019-12-07 – 27 SMTP Command Injection in Appointment Emails via Newlines #1509216 Valid Injection and Smuggling Medium 2022-12-27 – 27 Profile of disabled user stays accessible #1675014 Valid Access Control Low 2022-11-26 $100 27 Password of talk conversations can be bruteforced #2094473 Valid Authentication Medium 2023-11-12 – 27 X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted files #2597504 Valid Cryptography Medium 2024-12-15 – 27 Participants were able to blindly delete poll drafts of other users by ID #3247386 Valid Insecure Direct Object Reference Medium 2025-12-05 – 27 Reflected XSS in error pages (NC-SA-2017-008) #216812 Valid Cross-site Scripting Low 2017-05-15 $450 28 Blind Stored XSS on iOS App due to Unsanitized Webview #575562 Valid Cross-site Scripting Low 2020-03-07 $100 28 user_ldap app logs user passwords in the log file on level debug #2101165 Valid Cryptography Medium 2023-11-21 – 28 Non-admin users can reset app allowlist to the default #2250398 Valid Input Validation and Logic Medium 2024-01-18 – 28 External storage - global credentials returned to the client side in plaintext #2554079 Valid Information Disclosure Medium 2024-11-21 – 28 IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email #230328 Valid Insecure Direct Object Reference Medium 2017-09-16 – 29 Code injection in macOS Desktop Client #633266 Valid Command and Code Injection Low 2020-04-10 – 29 Database error shown to the user when using a long guest name in richdocuments #1067824 Valid Information Disclosure – 2021-02-07 – 29 Nextcloud mail does not respect download permissions in shares #1878255 Valid Access Control Low 2024-12-15 $250 29 ID4ME does not validate signature or expiration #1878391 Valid Cryptography Medium 2024-07-14 $750 29 Enabling Birthday Contact to any user #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 Attachments folder for Text app is accessible on Files Drop/Password protected shares #2376900 Valid Information Disclosure Low 2024-11-15 – 29 Possible to enumerate valid files in password protected shares/files drop shares as well as spam folder with files #2376909 Valid Information Disclosure Low 2025-02-21 – 29 Ability to by-pass second factor #2419776 Valid Authentication Medium 2024-07-14 $1,000 29 Passwords being stored as plain text in logging #469668 Valid Cryptography Low 2019-08-31 – 30 SSRF via potential filter bypass with too lax local domain checking Analysed #1608039 Valid Server-Side Request Forgery Low 2022-09-16 $250 30 Passcode bypass on Talk Android app Analysed #1784645 Valid Access Control Low 2023-01-09 – 30 HTML injection in search UI when selecting a circle with HTML in the display name Analysed #2210038 Valid Cross-site Scripting Low 2023-11-21 – 30 Open redirect when logging in with user_oidc Analysed #2720030 Valid Open Redirect – 2024-11-15 – 30 Missing ownership check in Tables app allows moving columns into tables of other users Analysed #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Tables app allowed users to view columns metadata information of any table #3138721 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30