End-to-end encrypted file-drops can be made inaccessible Analysed #1914115 Valid Access Control High 2023-06-22 $400 43 Path traversal allows tricking the Talk Android app into writing files into it's root directory Analysed #1997029 Valid File and Path Handling Medium 2023-08-14 – 43 Blind SSRF Vulnerability in Appstore Release Upload Form Analysed #2925666 Valid Access Control Low 2025-01-14 – 43 User can copy locked folders and gain access to the contents Analysed #2447316 Valid Access Control Medium 2024-11-16 $500 44 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays. Analysed #3590586 Valid Injection and Smuggling Medium 2026-04-20 – 44 OAuth2 "authorization_code" is valid indefinetly Analysed #1784162 Valid Misconfiguration and Insecure Design Low 2024-02-17 $100 45 Delete external storage of any user Analysed #2212627 Valid Access Control High 2023-11-21 – 45 Events information leaked with shared calendars on recurrence exceptions Analysed #2479325 Valid Information Disclosure Low 2024-06-14 $100 45 Password reset endpoint is not brute force protected Analysed #1987062 Valid Authentication High 2023-07-21 $500 46 Inviting excessive long email addresses to a calendar event makes the server unresponsive Analysed #2058337 Valid Denial of Service Medium 2023-10-16 – 46 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes Analysed #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 Can download files on Android app without permission Analysed #2380133 Valid Access Control Low 2026-01-16 $250 47 Exposing debug.log file leads to server full path disclosure Analysed #2778441 Valid Input Validation and Logic Medium 2025-09-29 – 47 Stored XSS in collabora via user name Analysed #968232 Valid Cross-site Scripting Low 2020-09-19 – 48 Mail stored HTML injection in subject text Analysed #3357036 Valid No weakness recorded Medium 2026-02-12 – 48 SSRF via User-Controlled Push proxyServer in Notifications Push Registration Analysed #3623149 Valid Server-Side Request Forgery Medium 2026-09-30 – 48 Download permissions can be changed by resharer Analysed #1724016 Valid Access Control Medium 2023-02-24 $500 49 Notes app can be tricked into using a received share created before the user logged in Analysed #2254151 Valid Input Validation and Logic Medium 2024-06-19 – 49 XSS in Desktop Client in the notifications Analysed #1668028 Valid Cross-site Scripting Low 2022-11-25 $750 50 Authentication bypass in Global Site Selector allows an attacker to log in as any user Analysed #2248689 Valid No weakness recorded Critical 2024-01-18 – 50 Clear text storage of proxy parameters and passwords Analysed #685990 Valid Cryptography Low 2020-09-16 – 53 Basic auth header on WebDAV requests is not bruteforce protected Analysed #1879549 Valid Authentication High 2023-06-02 – 53 SVG filter primitives bypass remote image blocking, enabling email tracking without consent. Analysed #3486747 Valid Information Disclosure Medium 2026-04-20 – 53 Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC Analysed #3489490 Valid Authentication High 2026-06-07 $2,500 55 Easy way to create a new Deck board without permission Analysed #2388183 Valid Access Control – 2026-01-16 $100 56 Calendar app allowed booking appointments without the generated token Analysed #3275810 Valid Insecure Direct Object Reference Low 2025-12-05 – 57 Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lock Analysed #331489 Valid Information Disclosure Low 2019-07-26 – 58 Default Nextcloud Server and Android Client leak sharee searches to Nextcloud Analysed #1167916 Valid Access Control Low 2021-06-15 $750 58 Arbitrary code execution in desktop client via OpenSSL config Analysed #622170 Valid Command and Code Injection Medium 2020-08-05 $100 59 Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Analysed #3304830 Valid Insecure Direct Object Reference Low 2026-05-08 – 60 Arbitrary Board Preference Injection via Deck Config API Analysed #3599383 Valid Access Control Medium 2026-09-17 $200 62 Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library Analysed #3249624 Valid File and Path Handling Medium 2025-10-16 – 63 Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes Analysed #3610332 Valid Input Validation and Logic Medium 2026-09-17 $150 63 Two-factor authentication enforcement bypass Analysed #1050244 Valid No weakness recorded High 2021-07-31 $750 64 Improper input validation in emoji field leads to sidebar UI denial of service Analysed #3599470 Valid Input Validation and Logic Low 2026-09-20 – 64 Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-Service Analysed #3399016 Valid Memory Corruption None 2026-05-01 – 65 Valid share tokens allow to access tempory upload files of share owner Analysed #3483708 Valid Access Control Medium 2026-06-07 – 65 ID4me feature of OpenID connect app available even when disabled Analysed #2376929 Valid Access Control Medium 2024-05-30 – 66 File-drop content is visible through the gallery app Analysed #719426 Valid No weakness recorded Medium 2020-01-31 – 68 Directory Listing of publicly available assets Analysed #2311179 Valid Information Disclosure Medium 2025-09-29 – 70 Nextcloud Desktop Client RCE via malicious URI schemes Analysed #1078002 Valid Injection and Smuggling Medium 2021-04-15 $1,000 73 TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot Analysed #3799010 Valid Insecure Direct Object Reference Medium 2026-08-14 – 73 Arbitrary SQL command injection Analysed #508487 Valid SQL Injection Critical 2019-07-21 – 77 CSRF protection on OIDC login is broken Analysed #1878381 Valid Cross-Site Request Forgery Medium 2023-04-04 $500 77 User deletion is not handled properly everywhere Analysed #1200700 Valid No weakness recorded Medium 2021-07-15 $1,000 78 Stored XSS Vulnerability via SVG File Analysed #3357808 Valid Cross-site Scripting Medium 2025-12-05 $150 79 SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution Analysed #3462991 Valid SQL Injection High 2026-05-15 – 80 No rate limiting for confirmation email lead to huge Mass mailings Analysed #997070 Valid Input Validation and Logic Medium 2020-11-04 – 82 RCE on Wordpress website Analysed #2248328 Valid Deserialization and Object Injection Critical 2023-12-28 – 83 WebAuthn app was updated based on public key Analysed #3360354 Valid Insecure Direct Object Reference Low 2026-02-06 – 84