Exposing debug.log file leads to server full path disclosure Analysed #2778441 Valid Input Validation and Logic Medium 2025-09-29 – 47 Can download files on Android app without permission Analysed #2380133 Valid Access Control Low 2026-01-16 $250 47 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes Analysed #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 Inviting excessive long email addresses to a calendar event makes the server unresponsive Analysed #2058337 Valid Denial of Service Medium 2023-10-16 – 46 Password reset endpoint is not brute force protected Analysed #1987062 Valid Authentication High 2023-07-21 $500 46 Events information leaked with shared calendars on recurrence exceptions Analysed #2479325 Valid Information Disclosure Low 2024-06-14 $100 45 Delete external storage of any user Analysed #2212627 Valid Access Control High 2023-11-21 – 45 OAuth2 "authorization_code" is valid indefinetly Analysed #1784162 Valid Misconfiguration and Insecure Design Low 2024-02-17 $100 45 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays. Analysed #3590586 Valid Injection and Smuggling Medium 2026-04-20 – 44 User can copy locked folders and gain access to the contents Analysed #2447316 Valid Access Control Medium 2024-11-16 $500 44 Blind SSRF Vulnerability in Appstore Release Upload Form Analysed #2925666 Valid Access Control Low 2025-01-14 – 43 Path traversal allows tricking the Talk Android app into writing files into it's root directory Analysed #1997029 Valid File and Path Handling Medium 2023-08-14 – 43 End-to-end encrypted file-drops can be made inaccessible Analysed #1914115 Valid Access Control High 2023-06-22 $400 43 SSL certificate not validated when registering with a provider Analysed #903424 Valid Cryptography Medium 2021-06-02 $300 43 Email not verified when changing afterwards on apps.nextcloud.com Analysed #2305880 Valid Misconfiguration and Insecure Design Low 2025-09-29 – 42 http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacement Analysed #209520 Valid Open Redirect – 2020-03-07 – 42 xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack. Analysed #2299069 Valid Injection and Smuggling – 2024-02-08 – 41 Can download files by zipping the folder Analysed #2247457 Valid Access Control Medium 2024-02-17 – 41 Remote code execution via path traversal in Zip extraction in the Extract app Analysed #765291 Valid File and Path Handling High 2020-03-07 – 40 Memory Leak in OCUtil.dll library in Desktop client can lead to DoS Analysed #588562 Valid Denial of Service Medium 2020-08-06 $100 40 Stored XSS in attachment-display exploitable through SameSite Analysed #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 Approval app allows users to request approval for other users file Analysed #3338748 Valid Authentication Medium 2025-12-05 – 39 No password length limit when creating a user as an administrator Analysed #1727424 Valid Denial of Service Low 2022-12-31 – 39 Scoped apptokens can be changed by that very apptoken Analysed #1193321 Valid Access Control High 2021-07-15 $1,000 39 Unauthenticated testing endpoint of notify_push expose internal IP Analysed #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 Deck app allowed user with "Can share" permission to modify permissions of other non-owners Analysed #3247499 Valid Access Control Medium 2025-12-05 – 38 admin_audit does not log actions on files in a group folder Analysed #2890071 Valid Other weaknesses Medium 2025-12-05 – 38 DNS pin middleware can be tricked into DNS rebinding allowing SSRF Analysed #2115212 Valid Server-Side Request Forgery Medium 2024-01-01 – 38 Read-only users can restore old versions Analysed #1356508 Valid Access Control Medium 2024-06-14 $500 38 Expired reshare links allow access to all files in share Analysed #452854 Valid Access Control Critical 2019-06-27 – 38 Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute) Analysed #3400143 Valid Authentication Medium 2026-04-13 $250 37 tabnabbing in roundcube webmail Analysed #3367676 Valid No weakness recorded – 2025-12-24 – 37 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com Analysed #2446531 Valid Cryptography Medium 2024-05-22 – 37 Code injection in Nextcloud Desktop Client for macOS Analysed #2307625 Valid Command and Code Injection – 2024-06-14 $250 37 Blind SSRF in Mail App Analysed #1869714 Valid Server-Side Request Forgery Low 2024-01-10 – 37 [Reflected XSS] In Request URL Analysed #515484 Valid Cross-site Scripting Low 2020-03-01 – 37 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups Analysed #3674940 Valid Access Control Medium 2026-09-17 – 36 Arbitrary read of all SVG files on a Nextcloud server Analysed #1302155 Valid File and Path Handling High 2023-03-26 $1,250 36 SQL Injection found in NextCloud Android App Content Provider Analysed #291764 Valid SQL Injection Low 2019-07-26 $150 36 Unquoted body background attribute enables CSS injection that bypasses remote image blocking Analysed #3590583 Valid Injection and Smuggling Medium 2026-04-20 – 35 Email Enumeration via Password-Protected Share Identity Verification Analysed #3507273 Valid Information Disclosure Low 2026-09-05 $100 35 2FA Session not expires after the password reset Analysed #486693 Valid Authentication Medium 2021-01-18 $50 35 No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deleted Analysed #194329 Valid Misconfiguration and Insecure Design – 2020-02-09 – 35 Mail auto configurator can be tricked into sending account information to wrong servers Analysed #2508422 Valid Information Disclosure High 2024-11-15 $100 34 Incomplete sanitization in SVG preview provider Analysed #2484499 Valid Information Disclosure Medium 2024-12-15 $250 34 Brute force protection allows to send more requests than intended Analysed #1918525 Valid Authentication Medium 2023-07-13 $500 34 Ability to read any emails through IDOR on Nextcloud Mail Analysed #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 App PIN code can be bypassed in Files iOS Analysed #2245437 Valid Authentication Low 2023-12-18 $100 33 SSRF via filter bypass due to lax checking on IPs Analysed #1702864 Valid Server-Side Request Forgery Medium 2023-02-10 $250 33 Can reshare read&share only folder with more permissions Analysed #2289425 Valid Access Control High 2024-07-14 $750 32