Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Ubuntu 12.04 Privilege Escalation#380782 | Informative | Access Control | – | 2018-12-18 | – | – |
| Username Enumeration#667613 | Informative | Information Disclosure | Low | 2019-11-11 | – | – |
| Directory Listing In Subdomain Of nextcloud.com#218199 | Informative | Information Disclosure | Low | 2017-07-14 | – | 1 |
| Cross Site Scripting#224108 | Informative | No weakness recorded | – | 2017-04-26 | – | 1 |
| Bypass hide download Nextcloud Share#865777 | Informative | Input Validation and Logic | High | 2020-10-05 | – | 1 |
| Denial of Service when entring an Array in email at seetings#961997 | Informative | No weakness recorded | Medium | 2020-08-19 | – | 1 |
| Leaking sensitive information through JSON file path.#1211061 | Informative | Information Disclosure | Medium | 2022-02-07 | – | 1 |
| help.nextcloud.com: Session Management Issue#145430 | Informative | No weakness recorded | – | 2016-06-17 | – | 2 |
| Directory Listing On download.nextcloud.com & Practical Attacks on PGP (Pretty Good Privacy)#145552 | Informative | Cryptography | – | 2016-06-17 | – | 2 |
| Lost Password CSRF#145583 | Informative | Cross-Site Request Forgery | – | 2016-06-19 | – | 2 |
| Deny access to download.nextcloud.com + folders#146314 | Informative | Information Disclosure | – | 2016-06-21 | – | 2 |
| BruteForce in to Admin Account#188205 | Informative | Authentication | High | 2016-12-04 | – | 2 |
| Nextcloud.com is vulnerable to SWEET32 attack#199445 | Informative | Cryptography | – | 2017-01-25 | – | 2 |
| Server version/OS type disclosure via HTTP Response Header#215372 | Informative | No weakness recorded | Low | 2017-03-23 | – | 2 |
| CSRF token validation is missing#221043 | Informative | Cross-Site Request Forgery | Medium | 2017-04-19 | – | 2 |
| The email API to test email-server settings is unlimited and can be used as a email bomb#222660 | Informative | Access Control | Medium | 2017-04-24 | – | 2 |
| Possible SSRF in email server settings(SMTP mode)#222667 | Informative | Server-Side Request Forgery | Medium | 2017-05-15 | – | 2 |
| information disclose#223759 | Informative | Information Disclosure | – | 2017-04-25 | – | 2 |
| Accessing to download.nextcloud.com from original ip adreess | insecure Download#374053 | Informative | Cryptography | – | 2018-07-12 | – | 2 |
| WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED)#696198 | Informative | Information Disclosure | Low | 2019-11-11 | – | 2 |
| Trusted server shared secret stored unencrypted in the database#1173670 | Informative | Access Control | Low | 2021-06-16 | – | 2 |
| No permission set on Activities [Android App]#145402 | Informative | Authentication | – | 2016-06-20 | – | 3 |
| failure to invalidate session on password change#145488 | Informative | Authentication | – | 2017-04-20 | – | 3 |
| Bruteforce attack is possible on newsletter.nextcloud.com#145722 | Informative | Authentication | – | 2016-06-19 | – | 3 |
| The application uses basic authentication.#151847 | Informative | Authentication | – | 2016-07-18 | – | 3 |
| Login Hints on Admin Panel#188195 | Informative | Misconfiguration and Insecure Design | Medium | 2016-12-05 | – | 3 |
| Content (Text) Injection at https://nextcloud.com#222805 | Informative | Misconfiguration and Insecure Design | Low | 2017-05-15 | – | 3 |
| Retrieval and alteration of exposed media on Android Oreo#462441 | Informative | Information Disclosure | Medium | 2019-06-26 | – | 3 |
| XSS On Nextcloud Integrated with zimbra drive#498852 | Informative | Cross-site Scripting | Medium | 2019-11-11 | – | 3 |
| Veracode and security audit record are publicly available#669365 | Informative | Information Disclosure | Low | 2019-09-10 | – | 3 |
| Federated shares are not password protected#1167817 | Informative | Authentication | Medium | 2021-06-16 | – | 3 |
| Nextcloud update checks leaks information#1173411 | Informative | Information Disclosure | None | 2021-05-01 | – | 3 |
| Default Nextcloud allows http federated shares#1183302 | Informative | No weakness recorded | Medium | 2021-05-11 | – | 3 |
| No admin audit log for auth tokens#1200992 | Informative | No weakness recorded | Low | 2021-06-16 | – | 3 |
| Information Exposure Through Directory Listing vulnerability#1476709 | Informative | Information Disclosure | Medium | 2022-02-11 | – | 3 |
| WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available#146093 | Informative | Information Disclosure | – | 2016-06-22 | – | 4 |
| REG: Content provider information leakage#146179 | Informative | Command and Code Injection | – | 2016-06-24 | – | 4 |
| Email Spoofing#200762 | Informative | Misconfiguration and Insecure Design | – | 2017-01-25 | – | 4 |
| SSRF at apps.nextcloud.com/developer/apps/releases/new#213358 | Informative | Server-Side Request Forgery | – | 2017-04-20 | – | 4 |
| Information Exposure Through Directory Listing#260221 | Informative | Information Disclosure | None | 2018-05-17 | – | 4 |
| Banner Grabbing - Apache Server Version Disclosure#348801 | Informative | Information Disclosure | – | 2018-05-17 | – | 4 |
| SignUp using Fake Email#664200 | Informative | Input Validation and Logic | – | 2019-08-02 | – | 4 |
| Full path disclosure vulnerability via Upload .htaccess file#919429 | Informative | Information Disclosure | – | 2020-07-09 | – | 4 |
| No admin audit entry for enabling/disabling 2FA#1200989 | Informative | No weakness recorded | Low | 2021-06-16 | – | 4 |
| Possible RCE#145343 | Informative | Command and Code Injection | – | 2018-03-08 | – | 5 |
| Vulnerable Javascript library#145517 | Informative | Information Disclosure | – | 2016-06-17 | – | 5 |
| Business/Functional logic bypass: Remove admins from admin group.#145745 | Informative | Access Control | – | 2016-06-19 | – | 5 |
| Email ID Disclosure.#146106 | Informative | Information Disclosure | – | 2016-06-20 | – | 5 |
| HTTP-Basic Authentication on logs.nextcloud.com#198673 | Informative | Misconfiguration and Insecure Design | – | 2017-01-17 | – | 5 |
| Drone Nextcloud#198773 | Informative | No weakness recorded | – | 2017-02-12 | – | 5 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.