No password confirmation required when using apptoken on sensitive endpoint #3566607 Valid Access Control Medium 2026-10-27 – 2 Website PHP source code returned in javascript #1794462 Valid No weakness recorded Medium 2023-04-10 – 4 Reference fetch can saturate the server bandwidth for 10 seconds #1806223 Valid Denial of Service Medium 2023-04-29 – 4 user_oidc app is missing bruteforce protection #1954711 Valid Authentication Medium 2023-06-23 – 4 Files Confidential tagging can be bypassed with # in filename #3682163 Valid Access Control Medium 2026-10-27 – 4 Public shares remain accessible via alternate endpoints after owner account is disabled #3620539 Valid Access Control Medium 2026-10-27 $270 6 Tables application does not respect sharing limitations set by admin #3642236 Valid Access Control Medium 2026-10-27 – 6 Open redirect on "Unsupported browser" warning #1977222 Valid Open Redirect Medium 2023-06-22 $150 8 Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone #3511955 Valid Access Control Medium 2026-10-27 – 9 Potential directory traversal in OC\Files\Node\Folder::getFullPath #1765631 Valid File and Path Handling Medium 2023-05-04 – 10 Document content of files can be obtained through Collabora for files of other users #1788222 Valid Access Control Medium 2023-05-04 – 10 Secure view trivial to bypass #1724021 Valid Access Control Medium 2023-03-30 $150 13 Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle #1893186 Valid Cross-site Scripting Medium 2023-05-15 – 13 Reference caching can leak data to unauthorized users #1767503 Valid Information Disclosure Medium 2023-01-13 – 14 Responsive Server-side Request Forgery (SSRF) #1895874 Valid Server-Side Request Forgery Medium 2023-10-19 – 15 Twitter Account hijack @nextcloudfrance #1916565 Valid No weakness recorded Medium 2023-03-30 – 15 Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections #3303283 Valid Server-Side Request Forgery Medium 2026-09-17 – 15 Error when editing a calendar appointment returns stacktrace and query #2108342 Valid Information Disclosure Medium 2024-01-17 – 16 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders #3506873 Valid Access Control Medium 2026-09-17 – 16 Chat room member disclosure via autocomplete API #1850407 Valid Access Control Medium 2023-03-25 – 17 Users can set up workflows using restricted and invisible system tags #1895976 Valid Access Control Medium 2023-05-17 – 17 SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards #3576823 Valid Server-Side Request Forgery Medium 2026-10-27 $250 17 see card comments after remove shared board #2289333 Valid Access Control Medium 2024-06-18 – 18 Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider #3696266 Valid File and Path Handling Medium 2026-08-24 – 18 Memcached used as RateLimiter backend is no-op #2110945 Valid Authentication Medium 2023-11-12 – 19 Deck app allows to spoof file extensions by using RTLO characters #2326618 Valid No weakness recorded Medium 2026-01-04 $100 19 Self XSS when pasting HTML into Text app with Ctrl+Shift+V #2211561 Valid Cross-site Scripting Medium 2023-12-21 – 20 Users can modify tags on files that do not belong to them #3040887 Valid Access Control Medium 2026-01-04 $150 20 Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist #2251074 Valid Injection and Smuggling Medium 2024-01-18 – 22 Calendar attachments of local files are offered to downloaded #3112033 Valid Input Validation and Logic Medium 2025-12-05 – 22 Improper restriction of excessive authentication attempts on WebDAV endpoint #1924212 Valid Authentication Medium 2023-08-10 – 23 Cross-User Lock/Unlock via Absolute DAV Path #3301553 Valid Authentication Medium 2026-09-17 – 23 Missing brute force protection on password confirmation modal #1842114 Valid Authentication Medium 2023-03-21 – 24 Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4 #2290680 Valid Access Control Medium 2024-07-14 $500 24 Nextcloud Tables app - inserting rows to an arbitrary table possible #2671404 Valid No weakness recorded Medium 2024-11-17 – 24 CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link #1741430 Valid Cross-Site Request Forgery Medium 2023-01-11 – 25 Event create can create attachments that link to other websites #2457588 Valid Open Redirect Medium 2024-07-14 $250 25 [nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed #2902856 Informative Server-Side Request Forgery Medium 2025-12-23 – 25 SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent #3590576 Valid File and Path Handling Medium 2026-04-20 – 26 Password of talk conversations can be bruteforced #2094473 Valid Authentication Medium 2023-11-12 – 27 X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted files #2597504 Valid Cryptography Medium 2024-12-15 – 27 Participants were able to blindly delete poll drafts of other users by ID #3247386 Valid Insecure Direct Object Reference Medium 2025-12-05 – 27 user_ldap app logs user passwords in the log file on level debug #2101165 Valid Cryptography Medium 2023-11-21 – 28 Non-admin users can reset app allowlist to the default #2250398 Valid Input Validation and Logic Medium 2024-01-18 – 28 External storage - global credentials returned to the client side in plaintext #2554079 Valid Information Disclosure Medium 2024-11-21 – 28 ID4ME does not validate signature or expiration #1878391 Valid Cryptography Medium 2024-07-14 $750 29 Enabling Birthday Contact to any user #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 Ability to by-pass second factor #2419776 Valid Authentication Medium 2024-07-14 $1,000 29 Missing ownership check in Tables app allows moving columns into tables of other users #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Tables app allowed users to view columns metadata information of any table #3138721 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30