Log pollution can lead to HTML Injection. #146278 Valid Cross-site Scripting – 2016-07-19 – 18 Registered users can change app password permissions for any user #297751 Valid Insecure Direct Object Reference Low 2018-02-08 $100 18 SSRF protection bypass #736867 Valid Server-Side Request Forgery Medium 2020-03-14 $100 18 Clients do not verify server public key #1192470 Valid No weakness recorded Low 2021-09-23 $250 18 Folder architecture and Filesizes of private file drop shares can be getten #1337422 Valid Information Disclosure Medium 2022-04-09 – 18 Disabled download shares still allow download through preview images #1745766 Valid Access Control Low 2022-12-31 – 18 App pin of the Android app can be bypassed via 3rdparty apps generating deep links #1825679 Valid Authentication Low 2023-05-04 – 18 see card comments after remove shared board #2289333 Valid Access Control Medium 2024-06-18 – 18 Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider #3696266 Valid File and Path Handling Medium 2026-08-24 – 18 Server side request forgery (SSRF) on nextcloud implementation. #145524 Informative No weakness recorded – 2016-06-17 – 19 Authentication Issue #146133 Valid Authentication – 2018-10-25 $50 19 SQLi allow query restriction bypass on exposed FileContentProvider #518669 Valid SQL Injection Low 2019-07-29 $100 19 When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL #1358977 Valid Input Validation and Logic Medium 2022-02-15 – 19 Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate #1596459 Valid Access Control Low 2022-12-25 – 19 [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only #1687410 Valid Cross-site Scripting Low 2022-12-18 – 19 Missing permission check when removing a photo from an album #1946298 Valid Access Control Low 2024-07-14 – 19 Memcached used as RateLimiter backend is no-op #2110945 Valid Authentication Medium 2023-11-12 – 19 Deck app allows to spoof file extensions by using RTLO characters #2326618 Valid No weakness recorded Medium 2026-01-04 $100 19 Team membership information returned on API level based on ID #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Persistent SMTP header injection via identity `organization` / `name` #3913012 Valid Memory Corruption None 2026-09-18 – 19 https://xmpp.nextcloud.com///;@www.google.com allows open redirect #211213 Valid Open Redirect – 2017-08-13 – 20 Session fixation in password protected public download. #237184 Valid Authentication Low 2018-10-25 – 20 bypass of 2FA #248656 Valid Authentication High 2018-07-29 $750 20 OAuth2 Access Token and App Password Security Vulnerability #343111 Valid Cryptography Medium 2018-07-21 – 20 Username and Access Token Disclousure #672623 Valid Misconfiguration and Insecure Design Low 2020-03-01 $250 20 Denial of Service by requesting to reset a password #812754 Valid Denial of Service High 2021-01-25 – 20 Access control missing while viewing the attachments in the "All boards" #916704 Valid Insecure Direct Object Reference Medium 2020-09-29 $150 20 Sensitive files/ data exists post deletion of user account #1222873 Valid Access Control Low 2022-05-20 – 20 Missing brute force protection on OAuth2 API controller #1258448 Valid Authentication Medium 2023-08-10 $500 20 [user_oidc] Unencrypted Communications #1687005 Valid Cryptography Low 2022-12-18 – 20 Self XSS when sending HTML as a comment in the Deck app #2058556 Valid Cross-site Scripting None 2024-01-18 – 20 Self XSS when pasting HTML into Text app with Ctrl+Shift+V #2211561 Valid Cross-site Scripting Medium 2023-12-21 – 20 Users can modify tags on files that do not belong to them #3040887 Valid Access Control Medium 2026-01-04 $150 20 Missing Duplicate Check allowing Multiple Retention Rules per System Tag #3521646 Valid Input Validation and Logic Low 2026-09-05 – 20 XSS through image upload of contacts using svg file with png extension #998422 Valid Cross-site Scripting Low 2020-12-26 – 21 Notification implicit PendingIntent in com.nextcloud.client allows to access contacts #1161401 Valid Information Disclosure Low 2022-05-27 $250 21 Possibility to delete files attached to deck cards of other users #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Full Passcode bypass on Nextcloud App iOS #1847368 Valid Access Control Low 2023-04-10 – 21 Open redirect in user_saml via RelayState parameter #2263044 Valid Open Redirect Low 2024-01-18 – 21 Deck app: Invalid tag color is accepted by API and breaks frontend UI #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Gallery: No feedback for invalid password #428660 Valid Input Validation and Logic Low 2019-07-27 $50 22 "Secure View" aka "Hide Download" can be bypassed easily #788257 Valid Access Control High 2020-04-10 – 22 XSS through image upload of contacts using svg file #894876 Valid Cross-site Scripting Low 2020-12-17 $100 22 Lack of bruteforce protection for TOTP 2FA #1265709 Valid Authentication Medium 2023-03-26 $750 22 SMTP Command Injection in iCalendar Attachments to Emails via Newlines #1516377 Valid Injection and Smuggling Medium 2022-07-04 – 22 Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist #2251074 Valid Injection and Smuggling Medium 2024-01-18 – 22 Calendar attachments of local files are offered to downloaded #3112033 Valid Input Validation and Logic Medium 2025-12-05 – 22 Persistent XSS via filename in projects #662204 Valid Cross-site Scripting Low 2020-03-01 $150 23 Possible denial of service when entering a loooong password #840598 Valid Authentication Medium 2020-07-29 $100 23 Ratelimiting can be bypassed using IPv6 subnets #1154003 Valid Authentication Low 2021-07-01 – 23