No password confirmation required when using apptoken on sensitive endpoint #3566607 Valid Access Control Medium 2026-10-27 – 2 Unauthenticated Persistent Denial-of-Service via Federated Share Injection #3679640 Valid Denial of Service High 2026-10-27 – 3 Files Confidential tagging can be bypassed with # in filename #3682163 Valid Access Control Medium 2026-10-27 – 4 Public shares remain accessible via alternate endpoints after owner account is disabled #3620539 Valid Access Control Medium 2026-10-27 $270 6 Tables application does not respect sharing limitations set by admin #3642236 Valid Access Control Medium 2026-10-27 – 6 Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory #3159877 Valid Information Disclosure None 2026-01-04 – 8 Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone #3511955 Valid Access Control Medium 2026-10-27 – 9 Public collectives allow to create pages #3533697 Valid Access Control Low 2026-09-17 – 9 Unauthorised access with hidden public link creation when sharing to a Team External Member #3625932 Valid Access Control Low 2026-10-27 $100 11 Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process #3772818 Valid Command and Code Injection Low 2026-10-24 – 11 Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API #3524971 Valid Information Disclosure Low 2026-10-27 – 12 Cross-room signaling injection enabling unauthorized force-mute #3636758 Valid Authentication Low 2026-10-21 – 12 Stored XSS in contacts app via organisation and title field #3293290 Valid Cross-site Scripting Low 2026-01-04 $100 15 Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections #3303283 Valid Server-Side Request Forgery Medium 2026-09-17 – 15 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders #3506873 Valid Access Control Medium 2026-09-17 – 16 Activity app does not verify federated file activity received from remote servers #3534050 Valid Authentication Low 2026-09-05 $150 16 FederationController::remoteWopiToken() returns full Wopi entity without token type validation #3568116 Valid Access Control Low 2026-10-27 – 17 SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards #3576823 Valid Server-Side Request Forgery Medium 2026-10-27 $250 17 Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider #3696266 Valid File and Path Handling Medium 2026-08-24 – 18 Deck app allows to spoof file extensions by using RTLO characters #2326618 Valid No weakness recorded Medium 2026-01-04 $100 19 Team membership information returned on API level based on ID #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Persistent SMTP header injection via identity `organization` / `name` #3913012 Valid Memory Corruption None 2026-09-18 – 19 Users can modify tags on files that do not belong to them #3040887 Valid Access Control Medium 2026-01-04 $150 20 Missing Duplicate Check allowing Multiple Retention Rules per System Tag #3521646 Valid Input Validation and Logic Low 2026-09-05 – 20 Deck app: Invalid tag color is accepted by API and breaks frontend UI #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Cross-User Lock/Unlock via Absolute DAV Path Analysed #3301553 Valid Authentication Medium 2026-09-17 – 23 Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app Analysed #3521639 Valid Memory Corruption Low 2026-09-05 – 23 SMTP header injection via C-escape `\r` in the recipient display name Analysed #3913007 Valid Memory Corruption None 2026-10-18 – 23 Predictable proposal participant tokens enable unauthorized access and vote submission Analysed #3385434 Valid Cryptography Low 2026-01-04 $100 25 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables Analysed #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent Analysed #3590576 Valid File and Path Handling Medium 2026-04-20 – 26 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet Analysed #3770482 Valid Access Control Medium 2026-09-18 – 31 Email Enumeration via Password-Protected Share Identity Verification Analysed #3507273 Valid Information Disclosure Low 2026-09-05 $100 35 Unquoted body background attribute enables CSS injection that bypasses remote image blocking Analysed #3590583 Valid Injection and Smuggling Medium 2026-04-20 – 35 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups Analysed #3674940 Valid Access Control Medium 2026-09-17 – 36 Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute) Analysed #3400143 Valid Authentication Medium 2026-04-13 $250 37 IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos #3518758 N/A Insecure Direct Object Reference – 2026-04-07 – 37 Unauthenticated testing endpoint of notify_push expose internal IP Analysed #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 Stored XSS in attachment-display exploitable through SameSite Analysed #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data #3382343 Informative Insecure Direct Object Reference Medium 2026-04-14 – 40 Unauthenticated SSRF via Public Reference API -Sharing Token Bypass #3479692 Informative No weakness recorded – 2026-03-31 – 41 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays. Analysed #3590586 Valid Injection and Smuggling Medium 2026-04-20 – 44 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes Analysed #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 Can download files on Android app without permission Analysed #2380133 Valid Access Control Low 2026-01-16 $250 47 Mail stored HTML injection in subject text Analysed #3357036 Valid No weakness recorded Medium 2026-02-12 – 48 SSRF via User-Controlled Push proxyServer in Notifications Push Registration Analysed #3623149 Valid Server-Side Request Forgery Medium 2026-09-30 – 48 SVG filter primitives bypass remote image blocking, enabling email tracking without consent. Analysed #3486747 Valid Information Disclosure Medium 2026-04-20 – 53 Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC Analysed #3489490 Valid Authentication High 2026-06-07 $2,500 55 Easy way to create a new Deck board without permission Analysed #2388183 Valid Access Control – 2026-01-16 $100 56 Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Analysed #3304830 Valid Insecure Direct Object Reference Low 2026-05-08 – 60