Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| demo.nextcloud.com: Content spoofing due to default Apache Error Page#155189 | Valid | Misconfiguration and Insecure Design | – | 2016-09-29 | – | 3 |
| xss for admin of https://newsletter.nextcloud.com#153799 | Valid | Cross-site Scripting | – | 2017-02-17 | – | 3 |
| The application uses basic authentication.#151847 | Informative | Authentication | – | 2016-07-18 | – | 3 |
| Content injection in subdomain#145853 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| Content Spoofing/Text Injection - docs.nextcloud.org#145850 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| Bruteforce attack is possible on newsletter.nextcloud.com#145722 | Informative | Authentication | – | 2016-06-19 | – | 3 |
| No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers#145612 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| https://newsletter.nextcloud.com Directory listening and Information Disclosure#145603 | Valid | Information Disclosure | – | 2016-06-18 | – | 3 |
| failure to invalidate session on password change#145488 | Informative | Authentication | – | 2017-04-20 | – | 3 |
| No rate limiting on password protected shared file link#145462 | Duplicate | Authentication | – | 2016-06-20 | – | 3 |
| No permission set on Activities [Android App]#145402 | Informative | Authentication | – | 2016-06-20 | – | 3 |
| Content Spoofing#145374 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 3 |
| No password confirmation required when using apptoken on sensitive endpoint#3566607 | Valid | Access Control | Medium | 2026-10-27 | – | 2 |
| Trusted server shared secret stored unencrypted in the database#1173670 | Informative | Access Control | Low | 2021-06-16 | – | 2 |
| DoS attack against the client when entering a long password#949712 | Valid | Denial of Service | Low | 2021-02-14 | – | 2 |
| The password of a mail share is not hashed if the password is given when the share is created#885041 | Valid | Authentication | Low | 2020-10-28 | – | 2 |
| Improper integrity protection of server-side encryption keys#732431 | Valid | Authentication | High | 2020-11-13 | – | 2 |
| WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED)#696198 | Informative | Information Disclosure | Low | 2019-11-11 | – | 2 |
| External Storage - WebDAV - New user has access to storage from deleted user (same user-ID)#549831 | Valid | Information Disclosure | – | 2021-02-14 | – | 2 |
| Content spoofing on https://surveyserver.nextcloud.com#473144 | Valid | Injection and Smuggling | Low | 2021-02-14 | – | 2 |
| Missing memory corruption protection on Windows release built#380102 | Valid | Memory Corruption | Medium | 2020-08-14 | – | 2 |
| Accessing to download.nextcloud.com from original ip adreess | insecure Download#374053 | Informative | Cryptography | – | 2018-07-12 | – | 2 |
| Nextcloud logs ldap passwords#264426 | Valid | Authentication | Low | 2020-01-31 | – | 2 |
| information disclose#223759 | Informative | Information Disclosure | – | 2017-04-25 | – | 2 |
| Stored XSS in Gallery application (NC-SA-2017-010)#222838 | Valid | Cross-site Scripting | Low | 2017-06-06 | – | 2 |
| Possible SSRF in email server settings(SMTP mode)#222667 | Informative | Server-Side Request Forgery | Medium | 2017-05-15 | – | 2 |
| The email API to test email-server settings is unlimited and can be used as a email bomb#222660 | Informative | Access Control | Medium | 2017-04-24 | – | 2 |
| CSRF token validation is missing#221043 | Informative | Cross-Site Request Forgery | Medium | 2017-04-19 | – | 2 |
| Share tokens for public calendars disclosed (NC-SA-2017-011)#218876 | Valid | Information Disclosure | Medium | 2017-06-06 | – | 2 |
| Server version/OS type disclosure via HTTP Response Header#215372 | Informative | No weakness recorded | Low | 2017-03-23 | – | 2 |
| Nextcloud.com is vulnerable to SWEET32 attack#199445 | Informative | Cryptography | – | 2017-01-25 | – | 2 |
| BruteForce in to Admin Account#188205 | Informative | Authentication | High | 2016-12-04 | – | 2 |
| Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)#164520 | Duplicate | Cross-site Scripting | – | 2016-08-31 | – | 2 |
| Content Injection - apps.nextcloud.com#161299 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 2 |
| Arbitrary File Upload in Logo & Log in image Theming setting.#155690 | Valid | Cross-site Scripting | – | 2016-10-05 | – | 2 |
| Content spoofing in cloud.nextcloud.com#152925 | Valid | Misconfiguration and Insecure Design | – | 2016-08-30 | – | 2 |
| Deny access to download.nextcloud.com + folders#146314 | Informative | Information Disclosure | – | 2016-06-21 | – | 2 |
| Content Injection in subdomain#145854 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 2 |
| Content Injection 404 page#145849 | Valid | Misconfiguration and Insecure Design | – | 2016-06-19 | – | 2 |
| Lost Password CSRF#145583 | Informative | Cross-Site Request Forgery | – | 2016-06-19 | – | 2 |
| Directory Listing On download.nextcloud.com & Practical Attacks on PGP (Pretty Good Privacy)#145552 | Informative | Cryptography | – | 2016-06-17 | – | 2 |
| Nextcloud server software: Content Spoofing#145463 | Valid | Misconfiguration and Insecure Design | – | 2016-07-19 | – | 2 |
| help.nextcloud.com: Session Management Issue#145430 | Informative | No weakness recorded | – | 2016-06-17 | – | 2 |
| Leaking sensitive information through JSON file path.#1211061 | Informative | Information Disclosure | Medium | 2022-02-07 | – | 1 |
| Denial of Service when entring an Array in email at seetings#961997 | Informative | No weakness recorded | Medium | 2020-08-19 | – | 1 |
| Bypass hide download Nextcloud Share#865777 | Informative | Input Validation and Logic | High | 2020-10-05 | – | 1 |
| xss on setup config page#812028 | Valid | Cross-site Scripting | Low | 2021-02-14 | – | 1 |
| Nextcloud Clickjacking Vulnerability#710996 | Duplicate | Misconfiguration and Insecure Design | Low | 2019-11-11 | – | 1 |
| Clickjacking on https://download.nextcloud.com/#662155 | Duplicate | Misconfiguration and Insecure Design | None | 2019-11-11 | – | 1 |
| Clickjacking on https://download.nextcloud.com#658011 | Duplicate | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.