Default settings leak federated cloud id to lookup server of all users #1173436 Valid Information Disclosure Low 2021-06-10 $350 11 Add to your nextcloud endpoint is not properly protected #1192144 Valid No weakness recorded Low 2021-08-11 $100 11 com.nextcloud.client bypass the protection lock in andoid app v 3.18.1 latest version. #1450368 Valid Access Control Low 2022-04-30 $200 11 [nextcloud/server] Moment.js vulnerable to Inefficient Regular Expression Complexity #1712329 Valid Authentication – 2022-12-09 – 11 Mail app - Blind SSRF via Sierve server fonctionnality and sieveHost parameter #1741525 Valid Server-Side Request Forgery Low 2023-02-06 – 11 Hide download previews are accessible without a watermark #1745755 Valid Access Control Low 2023-05-04 – 11 Mail app - blind SSRF via smtpHost parameter #1746582 Valid Server-Side Request Forgery Low 2023-02-06 – 11 New AppPassword can be generated without password confirmation #2067572 Valid Access Control High 2023-08-10 $250 11 Unauthorised access with hidden public link creation when sharing to a Team External Member #3625932 Valid Access Control Low 2026-10-27 $100 11 Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process #3772818 Valid Command and Code Injection Low 2026-10-24 – 11 No Rate Limiting on stats.nextcloud.com login #146424 Informative Misconfiguration and Insecure Design – 2016-06-22 – 12 WordPress <= 4.6.1 Stored XSS Via Theme File #197878 Valid Cross-site Scripting – 2017-01-13 – 12 Disclosure of administrators via JSON on nextcloud.com Wordpress #198012 Valid Information Disclosure – 2017-01-13 – 12 Wordpress 4.7.1 #201489 Valid No weakness recorded Low 2017-01-27 – 12 https://portal.nextcloud.com/.htaccess file is readable #220946 Valid Information Disclosure – 2017-04-14 – 12 Remote attacker can impersonate Social users via ActivityPub API #461308 Valid Deserialization and Object Injection – 2019-02-01 – 12 Predictable Random Number Generator #504731 Informative Cryptography Medium 2019-06-26 – 12 Able to bypass "Device credentials" Lock #507172 Valid Access Control Low 2019-07-26 – 12 XSS in image metadata field #896511 Valid Cross-site Scripting Medium 2020-08-05 – 12 Trusted servers exchange can be triggered by attacker #1167853 Valid Access Control Medium 2021-06-10 $750 12 Federated share accepting/declining is not logged in audit log #1200815 Valid Input Validation and Logic Low 2022-09-03 – 12 Access to arbitrary file of the Nextcloud Android app from within the Nextcloud Android app #1408692 Valid File and Path Handling Low 2022-09-11 $250 12 Missing length validation of user displayname allows to generate an SQL error #1588562 Valid Denial of Service Low 2022-12-20 – 12 Missing character limitation allows to put generate a database error #1596059 Valid Denial of Service Low 2023-01-09 – 12 Lack of Brute force protection while joining video call in talk section which is password protected #1596673 Valid Information Disclosure Low 2022-08-08 – 12 Information exposure in in guzzlehttp/guzzle (https://github.com/nextcloud/3rdparty/tree/master/guzzlehttp/guzzle) #1604606 Valid Information Disclosure Low 2022-09-16 – 12 Mail app stores cleartext password in database until OAUTH2 setup is done #1806275 Valid Authentication Low 2023-03-08 – 12 No password length restriction in reset password endpoint #1820864 Valid Denial of Service Low 2023-02-09 – 12 Text does not respect 'Allow download' permissions #1965156 Valid Access Control Low 2023-08-23 $250 12 Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API #3524971 Valid Information Disclosure Low 2026-10-27 – 12 Cross-room signaling injection enabling unauthorized force-mute #3636758 Valid Authentication Low 2026-10-21 – 12 Design Issues on ( ███ ) Lead to show ( IPS of Users ) #218733 Valid No weakness recorded Medium 2017-04-05 – 13 Content Spoofing/Text Injection in https://demo.nextcloud.com #222058 Valid Misconfiguration and Insecure Design Low 2017-04-28 – 13 Talk / spreed: Disclosure of Room names and participants for password protected rooms #428010 Valid Information Disclosure Medium 2019-04-17 $50 13 Bypassing lock protection #490946 Valid Authentication Low 2019-07-26 $50 13 Only the file extensions are checked, not the MIME types as configured #697959 Valid No weakness recorded Medium 2020-03-14 – 13 Stored XSS in markdown file with Nextcloud Talk using Internet Explorer #1023787 Valid Cross-site Scripting Low 2021-02-19 – 13 End to end encryption public key is not properly verified on Desktop and Android #1189162 Valid No weakness recorded Medium 2021-09-23 $1,500 13 Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board #1450117 Valid Insecure Direct Object Reference Medium 2022-05-20 – 13 Desktop client does not verify received singed certificate in end to end encryption #1679267 Valid Cryptography Medium 2023-04-27 $1,000 13 Database resource exhaustion for logged-in users via sharee recommendations with circles #1688199 Valid Denial of Service Medium 2022-11-26 $250 13 Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link #1720043 Valid Command and Code Injection Medium 2023-02-10 – 13 Secure view trivial to bypass #1724021 Valid Access Control Medium 2023-03-30 $150 13 Mail app - blind SSRF via imapHost parameter #1736390 Valid Server-Side Request Forgery Low 2023-02-06 – 13 Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle #1893186 Valid Cross-site Scripting Medium 2023-05-15 – 13 Nextcloud Tables v1 Share Enumeration Without Authorization (Regression of CVE-2024-52507) #3334165 Valid Authentication Low 2025-12-05 – 13 Nextcloud 10.0 privilege escalation issue - Normal user can mask external storage shared by admin #165229 Valid Access Control Medium 2020-03-01 – 14 Unauthenticated Stored xss #168054 N/A Cross-site Scripting – 2016-09-13 – 14 Stored XSS in OAuth redirect URI #261138 Valid Cross-site Scripting Low 2019-05-11 – 14 Nextcloud domain and name of every user leaked to lookup server #508490 Valid Information Disclosure Medium 2019-11-26 – 14