User can delete data in shared folders he's not autorized to access Analysed #642515 Valid Access Control Medium 2020-04-10 – 173 Access to all files of remote user through shared file Analysed #258084 Valid Information Disclosure Medium 2020-03-01 – 154 Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope Analysed #3617729 Valid Information Disclosure Medium 2026-09-04 $250 101 Re-Sharing allows increase of privileges Analysed #889243 Valid Access Control Medium 2020-09-28 – 92 User deletion is not handled properly everywhere Analysed #1200700 Valid No weakness recorded Medium 2021-07-15 $1,000 78 TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot Analysed #3799010 Valid Insecure Direct Object Reference Medium 2026-08-14 – 73 Nextcloud Desktop Client RCE via malicious URI schemes Analysed #1078002 Valid Injection and Smuggling Medium 2021-04-15 $1,000 73 Valid share tokens allow to access tempory upload files of share owner Analysed #3483708 Valid Access Control Medium 2026-06-07 – 65 Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes Analysed #3610332 Valid Input Validation and Logic Medium 2026-09-17 $150 63 Arbitrary Board Preference Injection via Deck Config API Analysed #3599383 Valid Access Control Medium 2026-09-17 $200 62 Arbitrary code execution in desktop client via OpenSSL config Analysed #622170 Valid Command and Code Injection Medium 2020-08-05 $100 59 Download permissions can be changed by resharer Analysed #1724016 Valid Access Control Medium 2023-02-24 $500 49 SSRF via User-Controlled Push proxyServer in Notifications Push Registration Analysed #3623149 Valid Server-Side Request Forgery Medium 2026-09-30 – 48 Inviting excessive long email addresses to a calendar event makes the server unresponsive Analysed #2058337 Valid Denial of Service Medium 2023-10-16 – 46 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays. Analysed #3590586 Valid Injection and Smuggling Medium 2026-04-20 – 44 SSL certificate not validated when registering with a provider Analysed #903424 Valid Cryptography Medium 2021-06-02 $300 43 Can download files by zipping the folder Analysed #2247457 Valid Access Control Medium 2024-02-17 – 41 Memory Leak in OCUtil.dll library in Desktop client can lead to DoS Analysed #588562 Valid Denial of Service Medium 2020-08-06 $100 40 Stored XSS in attachment-display exploitable through SameSite Analysed #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 Approval app allows users to request approval for other users file Analysed #3338748 Valid Authentication Medium 2025-12-05 – 39 Deck app allowed user with "Can share" permission to modify permissions of other non-owners Analysed #3247499 Valid Access Control Medium 2025-12-05 – 38 Read-only users can restore old versions Analysed #1356508 Valid Access Control Medium 2024-06-14 $500 38 Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute) Analysed #3400143 Valid Authentication Medium 2026-04-13 $250 37 2FA Session not expires after the password reset Analysed #486693 Valid Authentication Medium 2021-01-18 $50 35 Bypass password confirmation via Context-dependent access control (CDCA) Analysed #2120667 Valid Access Control Medium 2024-01-17 $100 32 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet Analysed #3770482 Valid Access Control Medium 2026-09-18 – 31 Missing ownership check in Tables app allows moving columns into tables of other users Analysed #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Enabling Birthday Contact to any user Analysed #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 Non-admin users can reset app allowlist to the default Analysed #2250398 Valid Input Validation and Logic Medium 2024-01-18 – 28 user_ldap app logs user passwords in the log file on level debug Analysed #2101165 Valid Cryptography Medium 2023-11-21 – 28 Participants were able to blindly delete poll drafts of other users by ID Analysed #3247386 Valid Insecure Direct Object Reference Medium 2025-12-05 – 27 SMTP Command Injection in Appointment Emails via Newlines Analysed #1509216 Valid Injection and Smuggling Medium 2022-12-27 – 27 CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link Analysed #1741430 Valid Cross-Site Request Forgery Medium 2023-01-11 – 25 Cards in Deck are readable by any user Analysed #1331728 Valid Information Disclosure Medium 2023-03-26 – 25 Leak arbitrary file under nextcloud android client privacy directory Analysed #1142918 Valid No weakness recorded Medium 2021-07-17 – 25 Missing brute force protection on password confirmation modal Analysed #1842114 Valid Authentication Medium 2023-03-21 – 24 Cross-User Lock/Unlock via Absolute DAV Path Analysed #3301553 Valid Authentication Medium 2026-09-17 – 23 Session fixation on public talk links Analysed #1181962 Valid Authentication Medium 2021-06-16 $100 23