Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Clickjacking on https://nextcloud.com/#661768 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | – |
| Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/#403909 | Duplicate | Information Disclosure | – | 2019-01-07 | – | 1 |
| Clickjacking on https://download.nextcloud.com#658011 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Clickjacking on https://download.nextcloud.com/#662155 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Nextcloud Clickjacking Vulnerability#710996 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)#164520 | Duplicate | Cross-site Scripting | – | 2016-08-31 | – | 2 |
| No rate limiting on password protected shared file link#145462 | Duplicate | Authentication | – | 2016-06-20 | – | 3 |
| The email API to reset password is unlimited and can be used as a email bomb#222080 | Duplicate | Access Control | – | 2017-04-20 | – | 4 |
| Disclosed Version of PORTS SSH|HTTP|SSL#358102 | Duplicate | Information Disclosure | – | 2018-06-14 | – | 4 |
| Missing SPF Flags on nextcloud.com#205250 | Duplicate | Misconfiguration and Insecure Design | – | 2017-02-10 | – | 5 |
| Email Spoofing#793532 | Duplicate | Input Validation and Logic | – | 2020-02-20 | – | 6 |
| NextCloud is also Accepting OCTET-STREAM Type of Documents instead of jpg or Imge Files Only#271253 | Duplicate | Authentication | – | 2019-04-11 | – | 7 |
| Wordpress Users Disclosure#625199 | Duplicate | Information Disclosure | – | 2019-07-01 | – | 8 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.