Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Bookmarks: Delete all existing bookmarks of a user#154529 | Valid | Access Control | – | 2016-08-08 | – | 4 |
| Bypassing quota limit#173622 | Valid | Access Control | – | 2017-03-10 | – | 4 |
| Filename enumeration && DoS#174524 | Valid | Denial of Service | – | 2017-02-09 | – | 4 |
| Content spoofing due to the improper behavior of the 403 page in Private Server#177335 | Valid | Misconfiguration and Insecure Design | – | 2016-10-31 | – | 4 |
| Content Spoofing in "files" app#179073 | Valid | Misconfiguration and Insecure Design | – | 2017-03-06 | $50 | 4 |
| Stored XSS on new Calling plugin (spreed)#190870 | Valid | Cross-site Scripting | High | 2016-12-13 | – | 4 |
| Review remote code execution in SwiftMailer#194564 | Valid | Command and Code Injection | None | 2017-02-18 | – | 4 |
| Email Spoofing#200762 | Informative | Misconfiguration and Insecure Design | – | 2017-01-25 | – | 4 |
| SSRF at apps.nextcloud.com/developer/apps/releases/new#213358 | Informative | Server-Side Request Forgery | – | 2017-04-20 | – | 4 |
| The email API to reset password is unlimited and can be used as a email bomb#222080 | Duplicate | Access Control | Low | 2017-04-20 | – | 4 |
| Clickjacking In https://demo.nextcloud.com#222762 | N/A | Misconfiguration and Insecure Design | Critical | 2017-05-20 | – | 4 |
| Nextcloud Server Remote Command Execution#226896 | N/A | No weakness recorded | High | 2017-05-10 | – | 4 |
| Information Exposure Through Directory Listing#260221 | Informative | Information Disclosure | None | 2018-05-17 | – | 4 |
| Banner Grabbing - Apache Server Version Disclosure#348801 | Informative | Information Disclosure | – | 2018-05-17 | – | 4 |
| Disclosed Version of PORTS SSH|HTTP|SSL#358102 | Duplicate | Information Disclosure | Low | 2018-06-14 | – | 4 |
| Stored XSS on scan.nextcloud.com#390728 | Valid | Cross-site Scripting | Low | 2020-03-01 | – | 4 |
| SignUp using Fake Email#664200 | Informative | Input Validation and Logic | – | 2019-08-02 | – | 4 |
| Social App does not validate server certificates for outgoing connections#915585 | Valid | Cryptography | Medium | 2020-11-17 | – | 4 |
| Full path disclosure vulnerability via Upload .htaccess file#919429 | Informative | Information Disclosure | – | 2020-07-09 | – | 4 |
| PIN for passwordless WebAuthn is asked for but not verified#924393 | Valid | Authentication | Medium | 2020-10-28 | – | 4 |
| DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data.#1147611 | Valid | Denial of Service | High | 2021-06-01 | – | 4 |
| No admin audit entry for enabling/disabling 2FA#1200989 | Informative | No weakness recorded | Low | 2021-06-16 | – | 4 |
| Ratelimits do not apply to OCS DataResponse#1214158 | Valid | Authentication | None | 2021-08-11 | – | 4 |
| Brute force protections don't work#1596918 | Valid | Information Disclosure | Low | 2022-09-03 | – | 4 |
| @nextcloud/logger NPM package brings vulnerable ansi-regex version#1607601 | Valid | Denial of Service | Low | 2022-07-29 | – | 4 |
| Exception logging in Sharepoint app reveals clear-text connection details#1652903 | Valid | Cryptography | Medium | 2022-11-26 | – | 4 |
| Website PHP source code returned in javascript#1794462 | Valid | No weakness recorded | Medium | 2023-04-10 | – | 4 |
| Reference fetch can saturate the server bandwidth for 10 seconds#1806223 | Valid | Denial of Service | Medium | 2023-04-29 | – | 4 |
| user_oidc app is missing bruteforce protection#1954711 | Valid | Authentication | Medium | 2023-06-23 | – | 4 |
| Files Confidential tagging can be bypassed with # in filename#3682163 | Valid | Access Control | Medium | 2026-10-27 | – | 4 |
| Possible RCE#145343 | Informative | Command and Code Injection | – | 2018-03-08 | – | 5 |
| nextcloud.com: Content Injection Custom 404 Error#145344 | Valid | Misconfiguration and Insecure Design | – | 2016-06-17 | – | 5 |
| Vulnerable Javascript library#145517 | Informative | Information Disclosure | – | 2016-06-17 | – | 5 |
| Business/Functional logic bypass: Remove admins from admin group.#145745 | Informative | Access Control | – | 2016-06-19 | – | 5 |
| Email ID Disclosure.#146106 | Informative | Information Disclosure | – | 2016-06-20 | – | 5 |
| More content spoofing through dir param in the files app#154827 | Valid | Misconfiguration and Insecure Design | – | 2016-11-04 | $50 | 5 |
| Information Disclosure of .htaccess file in Private Server/Subdomain#163106 | Valid | Information Disclosure | – | 2016-08-26 | – | 5 |
| Dav sharing permissions issue#174896 | Valid | Access Control | – | 2017-05-20 | – | 5 |
| URI scheme bypass in mail app lead to HTML content spoof and opener control#175085 | Valid | Misconfiguration and Insecure Design | – | 2017-01-12 | – | 5 |
| Limitation of app specific password scope can be bypassed (NC-SA-2017-009)#191979 | Valid | Access Control | Low | 2017-05-08 | $300 | 5 |
| HTTP-Basic Authentication on logs.nextcloud.com#198673 | Informative | Misconfiguration and Insecure Design | – | 2017-01-17 | – | 5 |
| Drone Nextcloud#198773 | Informative | No weakness recorded | – | 2017-02-12 | – | 5 |
| Missing SPF Flags on nextcloud.com#205250 | Duplicate | Misconfiguration and Insecure Design | – | 2017-02-10 | – | 5 |
| LDAP login possible even though account doesn't match user filter#205908 | Valid | Authentication | None | 2019-07-27 | – | 5 |
| Version 4.7.2 of wordpress is vulnerable#211206 | Valid | No weakness recorded | High | 2017-03-07 | – | 5 |
| Content spoofing due to the improper behavior of the 403 page#212770 | Valid | Misconfiguration and Insecure Design | – | 2017-05-18 | – | 5 |
| Missing Rate Limiting protection leading to mass triggering of e-mails#224927 | Valid | Misconfiguration and Insecure Design | Medium | 2017-06-05 | – | 5 |
| RTLO character allowed in shared files#229170 | Informative | Misconfiguration and Insecure Design | Medium | 2020-08-17 | – | 5 |
| Shared file link - password protection bypass under certain conditions#231917 | Valid | Information Disclosure | Medium | 2018-09-25 | $50 | 5 |
| Unauthenticated 'display name' information leak on enumeration of login names#237232 | Valid | Information Disclosure | Medium | 2020-03-01 | – | 5 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,683 analysed so far), which can be wrong. Data as of 2026-11-15.