Ability to read any emails through IDOR on Nextcloud Mail #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 App PIN code can be bypassed in Files iOS #2245437 Valid Authentication Low 2023-12-18 $100 33 SSRF via filter bypass due to lax checking on IPs #1702864 Valid Server-Side Request Forgery Medium 2023-02-10 $250 33 Can reshare read&share only folder with more permissions #2289425 Valid Access Control High 2024-07-14 $750 32 Bypass password confirmation via Context-dependent access control (CDCA) #2120667 Valid Access Control Medium 2024-01-17 $100 32 Cross site scripting - XSRF Token #858255 Valid Cross-site Scripting – 2020-06-14 – 32 Group admins can remove arbitrary data from "data" directory (including admin data) #508493 Valid Access Control – 2019-08-12 – 32 I am because bug #226097 Spam No weakness recorded – 2017-05-04 – 32 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet #3770482 Valid Access Control Medium 2026-09-18 – 31 Share information of Tables app is not limited to affected users #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 Bruteforce protection in password verification can be bypassed #2230915 Valid Authentication Medium 2024-01-17 – 31 Admins can change authentication details of user configured external storage #2107934 Valid Access Control Low 2023-12-21 $100 31 OAuth2 client_secret stored in plain text in the database #1994324 Valid Cryptography Medium 2023-11-15 $100 31 Tables app allowed users to view columns metadata information of any table #3138721 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Missing ownership check in Tables app allows moving columns into tables of other users #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Open redirect when logging in with user_oidc #2720030 Valid Open Redirect – 2024-11-15 – 30 HTML injection in search UI when selecting a circle with HTML in the display name #2210038 Valid Cross-site Scripting Low 2023-11-21 – 30 Passcode bypass on Talk Android app #1784645 Valid Access Control Low 2023-01-09 – 30 SSRF via potential filter bypass with too lax local domain checking #1608039 Valid Server-Side Request Forgery Low 2022-09-16 $250 30 Passwords being stored as plain text in logging #469668 Valid Cryptography – 2019-08-31 – 30 Ability to by-pass second factor #2419776 Valid Authentication Medium 2024-07-14 $1,000 29 Possible to enumerate valid files in password protected shares/files drop shares as well as spam folder with files #2376909 Valid Information Disclosure Low 2025-02-21 – 29 Attachments folder for Text app is accessible on Files Drop/Password protected shares #2376900 Valid Information Disclosure Low 2024-11-15 – 29 Enabling Birthday Contact to any user #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 ID4ME does not validate signature or expiration #1878391 Valid Cryptography Medium 2024-07-14 $750 29 Nextcloud mail does not respect download permissions in shares #1878255 Valid Access Control Low 2024-12-15 $250 29 Database error shown to the user when using a long guest name in richdocuments #1067824 Valid Information Disclosure – 2021-02-07 – 29 Code injection in macOS Desktop Client #633266 Valid Command and Code Injection – 2020-04-10 – 29 IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email #230328 Valid Insecure Direct Object Reference – 2017-09-16 – 29 External storage - global credentials returned to the client side in plaintext #2554079 Valid Information Disclosure Medium 2024-11-21 – 28 Non-admin users can reset app allowlist to the default #2250398 Valid Input Validation and Logic Medium 2024-01-18 – 28 user_ldap app logs user passwords in the log file on level debug #2101165 Valid Cryptography Medium 2023-11-21 – 28 Blind Stored XSS on iOS App due to Unsanitized Webview #575562 Valid Cross-site Scripting – 2020-03-07 $100 28 Reflected XSS in error pages (NC-SA-2017-008) #216812 Valid Cross-site Scripting – 2017-05-15 $450 28 Participants were able to blindly delete poll drafts of other users by ID #3247386 Valid Insecure Direct Object Reference Medium 2025-12-05 – 27 X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted files #2597504 Valid Cryptography Medium 2024-12-15 – 27 Password of talk conversations can be bruteforced #2094473 Valid Authentication Medium 2023-11-12 – 27 Profile of disabled user stays accessible #1675014 Valid Access Control Low 2022-11-26 $100 27 SMTP Command Injection in Appointment Emails via Newlines #1509216 Valid Injection and Smuggling Medium 2022-12-27 – 27 CSRF vulnerability that allows an attacker to modify encryption settings #630146 Valid Cross-Site Request Forgery – 2019-12-07 – 27 SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent #3590576 Valid File and Path Handling Medium 2026-04-20 – 26 XSS in PDF Viewer #819863 Valid Cross-site Scripting – 2020-05-23 $100 26 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 Predictable proposal participant tokens enable unauthorized access and vote submission #3385434 Valid Cryptography Low 2026-01-04 $100 25 [nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed #2902856 Informative Server-Side Request Forgery Medium 2025-12-23 – 25 Event create can create attachments that link to other websites #2457588 Valid Open Redirect Medium 2024-07-14 $250 25 CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link #1741430 Valid Cross-Site Request Forgery Medium 2023-01-11 – 25 Cards in Deck are readable by any user #1331728 Valid Information Disclosure Medium 2023-03-26 – 25 Leak arbitrary file under nextcloud android client privacy directory #1142918 Valid No weakness recorded – 2021-07-17 – 25 https://help.nextcloud.com::: Web cache poisoning attack #429747 Valid No weakness recorded – 2020-01-31 – 25