Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Directory Listing In Subdomain Of nextcloud.com#218199 | Informative | Information Disclosure | – | 2017-07-14 | – | 1 |
| Cross Site Scripting#224108 | Informative | No weakness recorded | – | 2017-04-26 | – | 1 |
| Nextcloud.com is vulnerable to SWEET32 attack#199445 | Informative | Cryptography | – | 2017-01-25 | – | 2 |
| Server version/OS type disclosure via HTTP Response Header#215372 | Informative | No weakness recorded | – | 2017-03-23 | – | 2 |
| Share tokens for public calendars disclosed (NC-SA-2017-011)#218876 | Valid | Information Disclosure | – | 2017-06-06 | – | 2 |
| CSRF token validation is missing#221043 | Informative | Cross-Site Request Forgery | – | 2017-04-19 | – | 2 |
| The email API to test email-server settings is unlimited and can be used as a email bomb#222660 | Informative | Access Control | – | 2017-04-24 | – | 2 |
| Possible SSRF in email server settings(SMTP mode)#222667 | Informative | Server-Side Request Forgery | – | 2017-05-15 | – | 2 |
| Stored XSS in Gallery application (NC-SA-2017-010)#222838 | Valid | Cross-site Scripting | – | 2017-06-06 | – | 2 |
| information disclose#223759 | Informative | Information Disclosure | – | 2017-04-25 | – | 2 |
| failure to invalidate session on password change#145488 | Informative | Authentication | – | 2017-04-20 | – | 3 |
| xss for admin of https://newsletter.nextcloud.com#153799 | Valid | Cross-site Scripting | – | 2017-02-17 | – | 3 |
| Content (Text) Injection at https://nextcloud.com#222805 | Informative | Misconfiguration and Insecure Design | – | 2017-05-15 | – | 3 |
| ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)#237860 | Valid | Denial of Service | – | 2017-06-08 | – | 3 |
| Information disclosure#152499 | N/A | Information Disclosure | – | 2017-04-20 | – | 4 |
| Bypassing quota limit#173622 | Valid | Access Control | – | 2017-03-10 | – | 4 |
| Filename enumeration && DoS#174524 | Valid | Denial of Service | – | 2017-02-09 | – | 4 |
| Content Spoofing in "files" app#179073 | Valid | Misconfiguration and Insecure Design | – | 2017-03-06 | $50 | 4 |
| Review remote code execution in SwiftMailer#194564 | Valid | Command and Code Injection | – | 2017-02-18 | – | 4 |
| Email Spoofing#200762 | Informative | Misconfiguration and Insecure Design | – | 2017-01-25 | – | 4 |
| SSRF at apps.nextcloud.com/developer/apps/releases/new#213358 | Informative | Server-Side Request Forgery | – | 2017-04-20 | – | 4 |
| The email API to reset password is unlimited and can be used as a email bomb#222080 | Duplicate | Access Control | – | 2017-04-20 | – | 4 |
| Clickjacking In https://demo.nextcloud.com#222762 | N/A | Misconfiguration and Insecure Design | – | 2017-05-20 | – | 4 |
| Nextcloud Server Remote Command Execution#226896 | N/A | No weakness recorded | – | 2017-05-10 | – | 4 |
| Dav sharing permissions issue#174896 | Valid | Access Control | – | 2017-05-20 | – | 5 |
| URI scheme bypass in mail app lead to HTML content spoof and opener control#175085 | Valid | Misconfiguration and Insecure Design | – | 2017-01-12 | – | 5 |
| Limitation of app specific password scope can be bypassed (NC-SA-2017-009)#191979 | Valid | Access Control | – | 2017-05-08 | $300 | 5 |
| HTTP-Basic Authentication on logs.nextcloud.com#198673 | Informative | Misconfiguration and Insecure Design | – | 2017-01-17 | – | 5 |
| Drone Nextcloud#198773 | Informative | No weakness recorded | – | 2017-02-12 | – | 5 |
| Missing SPF Flags on nextcloud.com#205250 | Duplicate | Misconfiguration and Insecure Design | – | 2017-02-10 | – | 5 |
| Version 4.7.2 of wordpress is vulnerable#211206 | Valid | No weakness recorded | – | 2017-03-07 | – | 5 |
| Content spoofing due to the improper behavior of the 403 page#212770 | Valid | Misconfiguration and Insecure Design | – | 2017-05-18 | – | 5 |
| Missing Rate Limiting protection leading to mass triggering of e-mails#224927 | Valid | Misconfiguration and Insecure Design | – | 2017-06-05 | – | 5 |
| Avatar image upload and bypass real image verification#145604 | Informative | Misconfiguration and Insecure Design | – | 2017-01-15 | – | 6 |
| Content Spoofing/Text Injection in nextcloud.com#213360 | Valid | Misconfiguration and Insecure Design | – | 2017-04-19 | – | 6 |
| Content spoofing due to the improper behavior of the 403 page#214340 | Valid | No weakness recorded | – | 2017-05-18 | – | 6 |
| XSS on IOS app via HTML rendering#157434 | Valid | Cross-site Scripting | – | 2017-04-20 | – | 7 |
| Bad content-type in response header when getting document can lead to html injection#173721 | Valid | Cross-site Scripting | – | 2017-01-12 | – | 7 |
| Calendar and addressbook names disclosed (NC-SA-2017-012)#203594 | Valid | Information Disclosure | – | 2017-05-08 | $183 | 7 |
| WordPress < 4.8.2 vulnerable to multiple attacks#269705 | Valid | Misconfiguration and Insecure Design | – | 2017-09-27 | – | 7 |
| User Information Disclosure via REST API#197877 | Valid | Information Disclosure | – | 2017-02-11 | – | 8 |
| Missing Rate Limit for Current Password field in nextcloud.com#199714 | Valid | Authentication | – | 2017-05-20 | – | 8 |
| Update php-saml library to 2.10.5#213789 | Valid | Cryptography | – | 2017-04-27 | – | 8 |
| Privilege escalation - Normal user can somehow make admin to delete shared folders#166581 | Valid | Access Control | – | 2017-05-20 | – | 9 |
| Bypass permissions#169680 | Valid | Access Control | – | 2017-02-09 | – | 9 |
| Files Drop: WebDAV endpoint is leaking existence of resources#187460 | Valid | Information Disclosure | – | 2017-01-01 | – | 9 |
| Reflected XSS in U2F plugin by shipping the example endpoints#192786 | Valid | Cross-site Scripting | – | 2017-03-22 | – | 10 |
| bug reporting template encourages users to paste config file with passwords#196878 | Valid | Information Disclosure | – | 2017-04-19 | – | 10 |
| Group admin can remove user from all his groups via API#199286 | Valid | No weakness recorded | – | 2017-02-23 | – | 10 |
| GIT Detected#221298 | Valid | Information Disclosure | – | 2017-04-20 | – | 10 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.