Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Code injection possible with malformed Nextcloud Talk chat commandsAnalysed#851807 | Valid | Command and Code Injection | High | 2020-06-02 | – | 317 |
| User can delete data in shared folders he's not autorized to accessAnalysed#642515 | Valid | Access Control | Medium | 2020-04-10 | – | 173 |
| Access to all files of remote user through shared fileAnalysed#258084 | Valid | Information Disclosure | Medium | 2020-03-01 | – | 154 |
| Missing ownership check on remote wipe endpointAnalysed#819807 | Valid | Insecure Direct Object Reference | High | 2020-04-19 | $500 | 141 |
| Re-Sharing allows increase of privilegesAnalysed#889243 | Valid | Access Control | Medium | 2020-09-28 | – | 92 |
| Arbitrary code execution in desktop client via OpenSSL configAnalysed#622170 | Valid | Command and Code Injection | Medium | 2020-08-05 | $100 | 59 |
| Clear text storage of proxy parameters and passwordsAnalysed#685990 | Valid | Cryptography | Low | 2020-09-16 | – | 53 |
| Stored XSS in collabora via user nameAnalysed#968232 | Valid | Cross-site Scripting | Low | 2020-09-19 | – | 48 |
| Remote code execution via path traversal in Zip extraction in the Extract appAnalysed#765291 | Valid | File and Path Handling | High | 2020-03-07 | – | 40 |
| Memory Leak in OCUtil.dll library in Desktop client can lead to DoSAnalysed#588562 | Valid | Denial of Service | Medium | 2020-08-06 | $100 | 40 |
| Code injection in macOS Desktop ClientAnalysed#633266 | Valid | Command and Code Injection | Low | 2020-04-10 | – | 29 |
| XSS in PDF ViewerAnalysed#819863 | Valid | Cross-site Scripting | Low | 2020-05-23 | $100 | 26 |
| Unrestricted file upload on the image of contactsAnalysed#808287 | Valid | Input Validation and Logic | Low | 2020-07-08 | $100 | 24 |
| Persistent XSS via filename in projectsAnalysed#662204 | Valid | Cross-site Scripting | Low | 2020-03-01 | $150 | 23 |
| XSS through image upload of contacts using svg fileAnalysed#894876 | Valid | Cross-site Scripting | Low | 2020-12-17 | $100 | 22 |
| XSS through image upload of contacts using svg file with png extensionAnalysed#998422 | Valid | Cross-site Scripting | Low | 2020-12-26 | – | 21 |
| Access control missing while viewing the attachments in the "All boards"Analysed#916704 | Valid | Insecure Direct Object Reference | Medium | 2020-09-29 | $150 | 20 |
| Username and Access Token DisclousureAnalysed#672623 | Valid | Misconfiguration and Insecure Design | Low | 2020-03-01 | $250 | 20 |
| SSRF protection bypassAnalysed#736867 | Valid | Server-Side Request Forgery | Medium | 2020-03-14 | $100 | 18 |
| XSS in desktop client via invalid server address on login formAnalysed#685552 | Valid | Cross-site Scripting | Medium | 2020-08-17 | – | 17 |
| User with read-only access to a share can gain write access to sub-folders in the shareAnalysed#619484 | Valid | Access Control | Medium | 2020-03-01 | – | 17 |
| Missing server side controls when editing the board’s sharing permissions per userAnalysed#827816 | Valid | Access Control | High | 2020-09-28 | – | 16 |
| Non-admin users can trigger writes to memcached by entering a malicious server as a share URLAnalysed#592864 | Valid | Injection and Smuggling | Medium | 2020-07-09 | $100 | 15 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.