Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Ubuntu 12.04 Privilege Escalation#380782 | Informative | Access Control | – | 2018-12-18 | – | – |
| Clickjacking on https://nextcloud.com/#661768 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | – |
| Username Enumeration#667613 | Informative | Information Disclosure | – | 2019-11-11 | – | – |
| [Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter#153251 | Valid | Misconfiguration and Insecure Design | – | 2016-12-05 | – | 1 |
| demo.nextcloud.com: Content spoofing due to default Apache Error Page#156425 | Valid | Misconfiguration and Insecure Design | – | 2016-08-30 | – | 1 |
| Content Injection - demo.nextcloud.com#161323 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 1 |
| Slow Http attack on nextcloud(DOS)#163823 | Valid | Denial of Service | – | 2016-10-05 | – | 1 |
| xss on demo.nextcloud.com due to outdated version#177713 | Valid | Cross-site Scripting | – | 2016-11-26 | – | 1 |
| Directory Listing In Subdomain Of nextcloud.com#218199 | Informative | Information Disclosure | – | 2017-07-14 | – | 1 |
| Cross Site Scripting#224108 | Informative | No weakness recorded | – | 2017-04-26 | – | 1 |
| WebDAV Empty Property search leads to full CPU usage#255822 | Valid | Denial of Service | – | 2020-03-01 | – | 1 |
| Broken link for wrong domain entry may be leveraged for Phishing, Misinformation, Serving Malware#279717 | Valid | No weakness recorded | – | 2020-03-01 | – | 1 |
| Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/#403909 | Duplicate | Information Disclosure | – | 2019-01-07 | – | 1 |
| Clickjacking on https://download.nextcloud.com#658011 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Clickjacking on https://download.nextcloud.com/#662155 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Nextcloud Clickjacking Vulnerability#710996 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| xss on setup config page#812028 | Valid | Cross-site Scripting | – | 2021-02-14 | – | 1 |
| Bypass hide download Nextcloud Share#865777 | Informative | Input Validation and Logic | – | 2020-10-05 | – | 1 |
| Denial of Service when entring an Array in email at seetings#961997 | Informative | No weakness recorded | – | 2020-08-19 | – | 1 |
| Leaking sensitive information through JSON file path.#1211061 | Informative | Information Disclosure | – | 2022-02-07 | – | 1 |
| help.nextcloud.com: Session Management Issue#145430 | Informative | No weakness recorded | – | 2016-06-17 | – | 2 |
| Nextcloud server software: Content Spoofing#145463 | Valid | Misconfiguration and Insecure Design | – | 2016-07-19 | – | 2 |
| Directory Listing On download.nextcloud.com & Practical Attacks on PGP (Pretty Good Privacy)#145552 | Informative | Cryptography | – | 2016-06-17 | – | 2 |
| Lost Password CSRF#145583 | Informative | Cross-Site Request Forgery | – | 2016-06-19 | – | 2 |
| Content Injection 404 page#145849 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 2 |
| Content Injection in subdomain#145854 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 2 |
| Deny access to download.nextcloud.com + folders#146314 | Informative | Information Disclosure | – | 2016-06-21 | – | 2 |
| Content spoofing in cloud.nextcloud.com#152925 | Valid | Misconfiguration and Insecure Design | – | 2016-08-30 | – | 2 |
| Arbitrary File Upload in Logo & Log in image Theming setting.#155690 | Valid | Cross-site Scripting | – | 2016-10-05 | – | 2 |
| Content Injection - apps.nextcloud.com#161299 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 2 |
| Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)#164520 | Duplicate | Cross-site Scripting | – | 2016-08-31 | – | 2 |
| BruteForce in to Admin Account#188205 | Informative | Authentication | – | 2016-12-04 | – | 2 |
| Nextcloud.com is vulnerable to SWEET32 attack#199445 | Informative | Cryptography | – | 2017-01-25 | – | 2 |
| Server version/OS type disclosure via HTTP Response Header#215372 | Informative | No weakness recorded | – | 2017-03-23 | – | 2 |
| Share tokens for public calendars disclosed (NC-SA-2017-011)#218876 | Valid | Information Disclosure | – | 2017-06-06 | – | 2 |
| CSRF token validation is missing#221043 | Informative | Cross-Site Request Forgery | – | 2017-04-19 | – | 2 |
| The email API to test email-server settings is unlimited and can be used as a email bomb#222660 | Informative | Access Control | – | 2017-04-24 | – | 2 |
| Possible SSRF in email server settings(SMTP mode)#222667 | Informative | Server-Side Request Forgery | – | 2017-05-15 | – | 2 |
| Stored XSS in Gallery application (NC-SA-2017-010)#222838 | Valid | Cross-site Scripting | – | 2017-06-06 | – | 2 |
| information disclose#223759 | Informative | Information Disclosure | – | 2017-04-25 | – | 2 |
| Nextcloud logs ldap passwords#264426 | Valid | Authentication | – | 2020-01-31 | – | 2 |
| Accessing to download.nextcloud.com from original ip adreess | insecure Download#374053 | Informative | Cryptography | – | 2018-07-12 | – | 2 |
| Missing memory corruption protection on Windows release built#380102 | Valid | Memory Corruption | – | 2020-08-14 | – | 2 |
| Content spoofing on https://surveyserver.nextcloud.com#473144 | Valid | Injection and Smuggling | – | 2021-02-14 | – | 2 |
| External Storage - WebDAV - New user has access to storage from deleted user (same user-ID)#549831 | Valid | Information Disclosure | – | 2021-02-14 | – | 2 |
| WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED)#696198 | Informative | Information Disclosure | – | 2019-11-11 | – | 2 |
| Improper integrity protection of server-side encryption keys#732431 | Valid | Authentication | – | 2020-11-13 | – | 2 |
| The password of a mail share is not hashed if the password is given when the share is created#885041 | Valid | Authentication | – | 2020-10-28 | – | 2 |
| DoS attack against the client when entering a long password#949712 | Valid | Denial of Service | – | 2021-02-14 | – | 2 |
| Trusted server shared secret stored unencrypted in the database#1173670 | Informative | Access Control | – | 2021-06-16 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.