Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/#403909 | Duplicate | Information Disclosure | Low | 2019-01-07 | – | 1 |
| Broken link for wrong domain entry may be leveraged for Phishing, Misinformation, Serving Malware#279717 | Valid | No weakness recorded | Low | 2020-03-01 | – | 1 |
| WebDAV Empty Property search leads to full CPU usage#255822 | Valid | Denial of Service | Medium | 2020-03-01 | – | 1 |
| Cross Site Scripting#224108 | Informative | No weakness recorded | – | 2017-04-26 | – | 1 |
| Directory Listing In Subdomain Of nextcloud.com#218199 | Informative | Information Disclosure | Low | 2017-07-14 | – | 1 |
| xss on demo.nextcloud.com due to outdated version#177713 | Valid | Cross-site Scripting | – | 2016-11-26 | – | 1 |
| Slow Http attack on nextcloud(DOS)#163823 | Valid | Denial of Service | – | 2016-10-05 | – | 1 |
| Content Injection - demo.nextcloud.com#161323 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 1 |
| demo.nextcloud.com: Content spoofing due to default Apache Error Page#156425 | Valid | Misconfiguration and Insecure Design | – | 2016-08-30 | – | 1 |
| [Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter#153251 | Valid | Misconfiguration and Insecure Design | – | 2016-12-05 | – | 1 |
| Username Enumeration#667613 | Informative | Information Disclosure | Low | 2019-11-11 | – | – |
| Clickjacking on https://nextcloud.com/#661768 | Duplicate | Misconfiguration and Insecure Design | None | 2019-11-11 | – | – |
| Ubuntu 12.04 Privilege Escalation#380782 | Informative | Access Control | – | 2018-12-18 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.