Exposing debug.log file leads to server full path disclosure #2778441 Valid Input Validation and Logic Medium 2025-09-29 – 47 Can download files on Android app without permission #2380133 Valid Access Control Low 2026-01-16 $250 47 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 Inviting excessive long email addresses to a calendar event makes the server unresponsive #2058337 Valid Denial of Service Medium 2023-10-16 – 46 Password reset endpoint is not brute force protected #1987062 Valid Authentication High 2023-07-21 $500 46 Events information leaked with shared calendars on recurrence exceptions #2479325 Valid Information Disclosure Low 2024-06-14 $100 45 Delete external storage of any user #2212627 Valid Access Control High 2023-11-21 – 45 OAuth2 "authorization_code" is valid indefinetly #1784162 Valid Misconfiguration and Insecure Design Low 2024-02-17 $100 45 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays. #3590586 Valid Injection and Smuggling Medium 2026-04-20 – 44 User can copy locked folders and gain access to the contents #2447316 Valid Access Control Medium 2024-11-16 $500 44 Blind SSRF Vulnerability in Appstore Release Upload Form #2925666 Valid Access Control Low 2025-01-14 – 43 Path traversal allows tricking the Talk Android app into writing files into it's root directory #1997029 Valid File and Path Handling Medium 2023-08-14 – 43 End-to-end encrypted file-drops can be made inaccessible #1914115 Valid Access Control High 2023-06-22 $400 43 SSL certificate not validated when registering with a provider #903424 Valid Cryptography – 2021-06-02 $300 43 Email not verified when changing afterwards on apps.nextcloud.com #2305880 Valid Misconfiguration and Insecure Design Low 2025-09-29 – 42 http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacement #209520 Valid Open Redirect – 2020-03-07 – 42 Unauthenticated SSRF via Public Reference API -Sharing Token Bypass #3479692 Informative No weakness recorded – 2026-03-31 – 41 xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack. #2299069 Valid Injection and Smuggling – 2024-02-08 – 41 Can download files by zipping the folder #2247457 Valid Access Control Medium 2024-02-17 – 41 BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data #3382343 Informative Insecure Direct Object Reference Medium 2026-04-14 – 40 Remote code execution via path traversal in Zip extraction in the Extract app #765291 Valid File and Path Handling – 2020-03-07 – 40 Memory Leak in OCUtil.dll library in Desktop client can lead to DoS #588562 Valid Denial of Service – 2020-08-06 $100 40 Stored XSS in attachment-display exploitable through SameSite #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 Approval app allows users to request approval for other users file #3338748 Valid Authentication Medium 2025-12-05 – 39 No password length limit when creating a user as an administrator #1727424 Valid Denial of Service Low 2022-12-31 – 39 Scoped apptokens can be changed by that very apptoken #1193321 Valid Access Control – 2021-07-15 $1,000 39 Unauthenticated testing endpoint of notify_push expose internal IP #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 Deck app allowed user with "Can share" permission to modify permissions of other non-owners #3247499 Valid Access Control Medium 2025-12-05 – 38 admin_audit does not log actions on files in a group folder #2890071 Valid Other weaknesses Medium 2025-12-05 – 38 Invisible Salamanders Attack against end_to_end_encryption in Nextcloud #2497947 Informative Cryptography Medium 2024-12-03 – 38 DNS pin middleware can be tricked into DNS rebinding allowing SSRF #2115212 Valid Server-Side Request Forgery Medium 2024-01-01 – 38 Read-only users can restore old versions #1356508 Valid Access Control Medium 2024-06-14 $500 38 Expired reshare links allow access to all files in share #452854 Valid Access Control – 2019-06-27 – 38 IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos #3518758 N/A Insecure Direct Object Reference – 2026-04-07 – 37 Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute) #3400143 Valid Authentication Medium 2026-04-13 $250 37 tabnabbing in roundcube webmail #3367676 Valid No weakness recorded – 2025-12-24 – 37 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com #2446531 Valid Cryptography Medium 2024-05-22 – 37 Code injection in Nextcloud Desktop Client for macOS #2307625 Valid Command and Code Injection – 2024-06-14 $250 37 Blind SSRF in Mail App #1869714 Valid Server-Side Request Forgery Low 2024-01-10 – 37 [Reflected XSS] In Request URL #515484 Valid Cross-site Scripting – 2020-03-01 – 37 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups #3674940 Valid Access Control Medium 2026-09-17 – 36 Arbitrary read of all SVG files on a Nextcloud server #1302155 Valid File and Path Handling – 2023-03-26 $1,250 36 SQL Injection found in NextCloud Android App Content Provider #291764 Valid SQL Injection – 2019-07-26 $150 36 Unquoted body background attribute enables CSS injection that bypasses remote image blocking #3590583 Valid Injection and Smuggling Medium 2026-04-20 – 35 Email Enumeration via Password-Protected Share Identity Verification #3507273 Valid Information Disclosure Low 2026-09-05 $100 35 2FA Session not expires after the password reset #486693 Valid Authentication – 2021-01-18 $50 35 No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deleted #194329 Valid Misconfiguration and Insecure Design – 2020-02-09 – 35 Mail auto configurator can be tricked into sending account information to wrong servers #2508422 Valid Information Disclosure High 2024-11-15 $100 34 Incomplete sanitization in SVG preview provider #2484499 Valid Information Disclosure Medium 2024-12-15 $250 34 Brute force protection allows to send more requests than intended #1918525 Valid Authentication Medium 2023-07-13 $500 34