Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/ Analysed #2946927 Valid No weakness recorded Low 2025-03-16 – 113 View-only guests could see deleted Collectives pages in the trashbin Analysed #3521434 Valid Access Control Low 2026-05-08 – 87 Improper input validation in emoji field leads to sidebar UI denial of service Analysed #3599470 Valid Input Validation and Logic Low 2026-09-20 – 64 Default Nextcloud Server and Android Client leak sharee searches to Nextcloud Analysed #1167916 Valid Access Control Low 2021-06-15 $750 58 Clear text storage of proxy parameters and passwords Analysed #685990 Valid Cryptography Low 2020-09-16 – 53 XSS in Desktop Client in the notifications Analysed #1668028 Valid Cross-site Scripting Low 2022-11-25 $750 50 Stored XSS in collabora via user name Analysed #968232 Valid Cross-site Scripting Low 2020-09-19 – 48 Can download files on Android app without permission Analysed #2380133 Valid Access Control Low 2026-01-16 $250 47 Events information leaked with shared calendars on recurrence exceptions Analysed #2479325 Valid Information Disclosure Low 2024-06-14 $100 45 SQL Injection found in NextCloud Android App Content Provider Analysed #291764 Valid SQL Injection Low 2019-07-26 $150 36 Email Enumeration via Password-Protected Share Identity Verification Analysed #3507273 Valid Information Disclosure Low 2026-09-05 $100 35 HTML injection in search UI when selecting a circle with HTML in the display name Analysed #2210038 Valid Cross-site Scripting Low 2023-11-21 – 30 SSRF via potential filter bypass with too lax local domain checking Analysed #1608039 Valid Server-Side Request Forgery Low 2022-09-16 $250 30 Passwords being stored as plain text in logging Analysed #469668 Valid Cryptography Low 2019-08-31 – 30 Code injection in macOS Desktop Client Analysed #633266 Valid Command and Code Injection Low 2020-04-10 – 29 Reflected XSS in error pages (NC-SA-2017-008) Analysed #216812 Valid Cross-site Scripting Low 2017-05-15 $450 28 XSS in PDF Viewer Analysed #819863 Valid Cross-site Scripting Low 2020-05-23 $100 26 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables Analysed #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 Unrestricted file upload on the image of contacts Analysed #808287 Valid Input Validation and Logic Low 2020-07-08 $100 24 Persistent XSS via filename in projects Analysed #662204 Valid Cross-site Scripting Low 2020-03-01 $150 23 XSS through image upload of contacts using svg file Analysed #894876 Valid Cross-site Scripting Low 2020-12-17 $100 22 Gallery: No feedback for invalid password Analysed #428660 Valid Input Validation and Logic Low 2019-07-27 $50 22 Deck app: Invalid tag color is accepted by API and breaks frontend UI Analysed #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Possibility to delete files attached to deck cards of other users Analysed #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Notification implicit PendingIntent in com.nextcloud.client allows to access contacts Analysed #1161401 Valid Information Disclosure Low 2022-05-27 $250 21 XSS through image upload of contacts using svg file with png extension Analysed #998422 Valid Cross-site Scripting Low 2020-12-26 – 21 [user_oidc] Unencrypted Communications Analysed #1687005 Valid Cryptography Low 2022-12-18 – 20 Sensitive files/ data exists post deletion of user account Analysed #1222873 Valid Access Control Low 2022-05-20 – 20 Username and Access Token Disclousure Analysed #672623 Valid Misconfiguration and Insecure Design Low 2020-03-01 $250 20 Team membership information returned on API level based on ID Analysed #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate Analysed #1596459 Valid Access Control Low 2022-12-25 – 19 SQLi allow query restriction bypass on exposed FileContentProvider Analysed #518669 Valid SQL Injection Low 2019-07-29 $100 19 Disabled download shares still allow download through preview images Analysed #1745766 Valid Access Control Low 2022-12-31 – 18 Registered users can change app password permissions for any user Analysed #297751 Valid Insecure Direct Object Reference Low 2018-02-08 $100 18 Missing brute force protection for passwords of password protected share links Analysed #1894653 Valid Authentication Low 2023-04-25 – 17 Password disclosure in initial setup of Mail App Analysed #1561471 Valid Cryptography Low 2022-09-03 – 17 DOM XSS vulnerability in search dialogue (NC-SA-2017-007) Analysed #213227 Valid Cross-site Scripting Low 2017-06-07 $250 16 Messages can still be seen on conversation after expiring when cron is misconfigured Analysed #1784310 Valid Information Disclosure Low 2023-02-27 – 15 Blind SSRF as normal user from mailapp Analysed #1913095 Valid Server-Side Request Forgery Low 2023-05-30 – 14 bypass forced password protection via circles app Analysed #1406926 Valid Input Validation and Logic Low 2022-06-19 $100 14 Android app does not clear end to end encryption keys Analysed #1189168 Valid No weakness recorded Low 2021-06-16 $100 14 Delete permission can be added on reshare Analysed #633245 Valid Access Control Low 2019-09-03 – 14 Mail app - blind SSRF via imapHost parameter Analysed #1736390 Valid Server-Side Request Forgery Low 2023-02-06 – 13 Stored XSS in markdown file with Nextcloud Talk using Internet Explorer Analysed #1023787 Valid Cross-site Scripting Low 2021-02-19 – 13 Bypassing lock protection Analysed #490946 Valid Authentication Low 2019-07-26 $50 13 Cross-room signaling injection enabling unauthorized force-mute Analysed #3636758 Valid Authentication Low 2026-10-21 – 12 Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API Analysed #3524971 Valid Information Disclosure Low 2026-10-27 – 12 Text does not respect 'Allow download' permissions Analysed #1965156 Valid Access Control Low 2023-08-23 $250 12 No password length restriction in reset password endpoint Analysed #1820864 Valid Denial of Service Low 2023-02-09 – 12 Mail app stores cleartext password in database until OAUTH2 setup is done Analysed #1806275 Valid Authentication Low 2023-03-08 – 12