Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Password reset endpoint is not brute force protectedAnalysed#1987062 | Valid | Authentication | High | 2023-07-21 | $500 | 46 |
| https://help.nextcloud.com::: Web cache poisoning attackAnalysed#429747 | Valid | No weakness recorded | High | 2020-01-31 | – | 25 |
| "Secure View" aka "Hide Download" can be bypassed easilyAnalysed#788257 | Valid | Access Control | High | 2020-04-10 | – | 22 |
| Denial of Service by requesting to reset a passwordAnalysed#812754 | Valid | Denial of Service | High | 2021-01-25 | – | 20 |
| Virtual Data Room / Hide download on collabora is easy to bypassAnalysed#1194606 | Valid | Access Control | High | 2021-08-07 | $150 | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.