OAuth2 client_secret stored in plain text in the database Analysed #1994324 Valid Cryptography Medium 2023-11-15 $100 31 Admins can change authentication details of user configured external storage Analysed #2107934 Valid Access Control Low 2023-12-21 $100 31 Bruteforce protection in password verification can be bypassed Analysed #2230915 Valid Authentication Medium 2024-01-17 – 31 Share information of Tables app is not limited to affected users Analysed #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet Analysed #3770482 Valid Access Control Medium 2026-09-18 – 31 I am because bug #226097 Spam No weakness recorded Critical 2017-05-04 – 32 Group admins can remove arbitrary data from "data" directory (including admin data) Analysed #508493 Valid Access Control High 2019-08-12 – 32 Cross site scripting - XSRF Token Analysed #858255 Valid Cross-site Scripting Medium 2020-06-14 – 32 Bypass password confirmation via Context-dependent access control (CDCA) Analysed #2120667 Valid Access Control Medium 2024-01-17 $100 32 Can reshare read&share only folder with more permissions Analysed #2289425 Valid Access Control High 2024-07-14 $750 32 SSRF via filter bypass due to lax checking on IPs Analysed #1702864 Valid Server-Side Request Forgery Medium 2023-02-10 $250 33 App PIN code can be bypassed in Files iOS Analysed #2245437 Valid Authentication Low 2023-12-18 $100 33 Ability to read any emails through IDOR on Nextcloud Mail Analysed #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 Brute force protection allows to send more requests than intended Analysed #1918525 Valid Authentication Medium 2023-07-13 $500 34 Incomplete sanitization in SVG preview provider Analysed #2484499 Valid Information Disclosure Medium 2024-12-15 $250 34 Mail auto configurator can be tricked into sending account information to wrong servers Analysed #2508422 Valid Information Disclosure High 2024-11-15 $100 34 No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deleted Analysed #194329 Valid Misconfiguration and Insecure Design – 2020-02-09 – 35 2FA Session not expires after the password reset Analysed #486693 Valid Authentication Medium 2021-01-18 $50 35 Email Enumeration via Password-Protected Share Identity Verification Analysed #3507273 Valid Information Disclosure Low 2026-09-05 $100 35 Unquoted body background attribute enables CSS injection that bypasses remote image blocking Analysed #3590583 Valid Injection and Smuggling Medium 2026-04-20 – 35 SQL Injection found in NextCloud Android App Content Provider Analysed #291764 Valid SQL Injection Low 2019-07-26 $150 36 Arbitrary read of all SVG files on a Nextcloud server Analysed #1302155 Valid File and Path Handling High 2023-03-26 $1,250 36 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups Analysed #3674940 Valid Access Control Medium 2026-09-17 – 36 [Reflected XSS] In Request URL Analysed #515484 Valid Cross-site Scripting Low 2020-03-01 – 37 Blind SSRF in Mail App Analysed #1869714 Valid Server-Side Request Forgery Low 2024-01-10 – 37 Code injection in Nextcloud Desktop Client for macOS Analysed #2307625 Valid Command and Code Injection – 2024-06-14 $250 37 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com Analysed #2446531 Valid Cryptography Medium 2024-05-22 – 37 tabnabbing in roundcube webmail Analysed #3367676 Valid No weakness recorded – 2025-12-24 – 37 Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute) Analysed #3400143 Valid Authentication Medium 2026-04-13 $250 37 IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos #3518758 N/A Insecure Direct Object Reference – 2026-04-07 – 37 Expired reshare links allow access to all files in share Analysed #452854 Valid Access Control Critical 2019-06-27 – 38 Read-only users can restore old versions Analysed #1356508 Valid Access Control Medium 2024-06-14 $500 38 DNS pin middleware can be tricked into DNS rebinding allowing SSRF Analysed #2115212 Valid Server-Side Request Forgery Medium 2024-01-01 – 38 Invisible Salamanders Attack against end_to_end_encryption in Nextcloud #2497947 Informative Cryptography Medium 2024-12-03 – 38 admin_audit does not log actions on files in a group folder Analysed #2890071 Valid Other weaknesses Medium 2025-12-05 – 38 Deck app allowed user with "Can share" permission to modify permissions of other non-owners Analysed #3247499 Valid Access Control Medium 2025-12-05 – 38 Unauthenticated testing endpoint of notify_push expose internal IP Analysed #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 Scoped apptokens can be changed by that very apptoken Analysed #1193321 Valid Access Control High 2021-07-15 $1,000 39 No password length limit when creating a user as an administrator Analysed #1727424 Valid Denial of Service Low 2022-12-31 – 39 Approval app allows users to request approval for other users file Analysed #3338748 Valid Authentication Medium 2025-12-05 – 39 Stored XSS in attachment-display exploitable through SameSite Analysed #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 Memory Leak in OCUtil.dll library in Desktop client can lead to DoS Analysed #588562 Valid Denial of Service Medium 2020-08-06 $100 40 Remote code execution via path traversal in Zip extraction in the Extract app Analysed #765291 Valid File and Path Handling High 2020-03-07 – 40 BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data #3382343 Informative Insecure Direct Object Reference Medium 2026-04-14 – 40 Can download files by zipping the folder Analysed #2247457 Valid Access Control Medium 2024-02-17 – 41 xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack. Analysed #2299069 Valid Injection and Smuggling – 2024-02-08 – 41 Unauthenticated SSRF via Public Reference API -Sharing Token Bypass #3479692 Informative No weakness recorded – 2026-03-31 – 41 http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacement Analysed #209520 Valid Open Redirect – 2020-03-07 – 42 Email not verified when changing afterwards on apps.nextcloud.com Analysed #2305880 Valid Misconfiguration and Insecure Design Low 2025-09-29 – 42 SSL certificate not validated when registering with a provider Analysed #903424 Valid Cryptography Medium 2021-06-02 $300 43