Private circle can be added to another circle via API despite visibility restriction Analysed #3511998 Valid Insecure Direct Object Reference Low 2026-05-08 $150 87 WebAuthn app was updated based on public key Analysed #3360354 Valid Insecure Direct Object Reference Low 2026-02-06 – 84 Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Analysed #3304830 Valid Insecure Direct Object Reference Low 2026-05-08 – 60 Calendar app allowed booking appointments without the generated token Analysed #3275810 Valid Insecure Direct Object Reference Low 2025-12-05 – 57 OAuth2 "authorization_code" is valid indefinetly Analysed #1784162 Valid Misconfiguration and Insecure Design Low 2024-02-17 $100 45 Blind SSRF Vulnerability in Appstore Release Upload Form Analysed #2925666 Valid Access Control Low 2025-01-14 – 43 Blind SSRF in Mail App Analysed #1869714 Valid Server-Side Request Forgery Low 2024-01-10 – 37 [Reflected XSS] In Request URL Analysed #515484 Valid Cross-site Scripting Low 2020-03-01 – 37 Share information of Tables app is not limited to affected users Analysed #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 Attachments folder for Text app is accessible on Files Drop/Password protected shares Analysed #2376900 Valid Information Disclosure Low 2024-11-15 – 29 Nextcloud mail does not respect download permissions in shares Analysed #1878255 Valid Access Control Low 2024-12-15 $250 29 Predictable proposal participant tokens enable unauthorized access and vote submission Analysed #3385434 Valid Cryptography Low 2026-01-04 $100 25 Open redirect in user_saml via RelayState parameter Analysed #2263044 Valid Open Redirect Low 2024-01-18 – 21 Full Passcode bypass on Nextcloud App iOS Analysed #1847368 Valid Access Control Low 2023-04-10 – 21 Missing permission check when removing a photo from an album Analysed #1946298 Valid Access Control Low 2024-07-14 – 19 App pin of the Android app can be bypassed via 3rdparty apps generating deep links Analysed #1825679 Valid Authentication Low 2023-05-04 – 18 Ransomware protection is missing extentions take 2 Analysed #1200785 Valid No weakness recorded Low 2021-07-16 $100 17 Activity app does not verify federated file activity received from remote servers Analysed #3534050 Valid Authentication Low 2026-09-05 $150 16 Stored XSS in contacts app via organisation and title field Analysed #3293290 Valid Cross-site Scripting Low 2026-01-04 $100 15 Nextcloud Tables v1 Share Enumeration Without Authorization (Regression of CVE-2024-52507) Analysed #3334165 Valid Authentication Low 2025-12-05 – 13 Missing length validation of user displayname allows to generate an SQL error Analysed #1588562 Valid Denial of Service Low 2022-12-20 – 12