Bypass password confirmation via Context-dependent access control (CDCA) Analysed #2120667 Valid Access Control Medium 2024-01-17 $100 32 Cross site scripting - XSRF Token Analysed #858255 Valid Cross-site Scripting Medium 2020-06-14 – 32 Group admins can remove arbitrary data from "data" directory (including admin data) Analysed #508493 Valid Access Control High 2019-08-12 – 32 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet Analysed #3770482 Valid Access Control Medium 2026-09-18 – 31 Share information of Tables app is not limited to affected users Analysed #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 Bruteforce protection in password verification can be bypassed Analysed #2230915 Valid Authentication Medium 2024-01-17 – 31 Admins can change authentication details of user configured external storage Analysed #2107934 Valid Access Control Low 2023-12-21 $100 31 OAuth2 client_secret stored in plain text in the database Analysed #1994324 Valid Cryptography Medium 2023-11-15 $100 31 Tables app allowed users to view columns metadata information of any table #3138721 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Missing ownership check in Tables app allows moving columns into tables of other users Analysed #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Open redirect when logging in with user_oidc Analysed #2720030 Valid Open Redirect – 2024-11-15 – 30 HTML injection in search UI when selecting a circle with HTML in the display name Analysed #2210038 Valid Cross-site Scripting Low 2023-11-21 – 30 Passcode bypass on Talk Android app Analysed #1784645 Valid Access Control Low 2023-01-09 – 30 SSRF via potential filter bypass with too lax local domain checking Analysed #1608039 Valid Server-Side Request Forgery Low 2022-09-16 $250 30 Passwords being stored as plain text in logging Analysed #469668 Valid Cryptography Low 2019-08-31 – 30 Ability to by-pass second factor Analysed #2419776 Valid Authentication Medium 2024-07-14 $1,000 29 Possible to enumerate valid files in password protected shares/files drop shares as well as spam folder with files Analysed #2376909 Valid Information Disclosure Low 2025-02-21 – 29 Attachments folder for Text app is accessible on Files Drop/Password protected shares Analysed #2376900 Valid Information Disclosure Low 2024-11-15 – 29 Enabling Birthday Contact to any user Analysed #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 ID4ME does not validate signature or expiration Analysed #1878391 Valid Cryptography Medium 2024-07-14 $750 29 Nextcloud mail does not respect download permissions in shares Analysed #1878255 Valid Access Control Low 2024-12-15 $250 29 Database error shown to the user when using a long guest name in richdocuments Analysed #1067824 Valid Information Disclosure – 2021-02-07 – 29 Code injection in macOS Desktop Client Analysed #633266 Valid Command and Code Injection Low 2020-04-10 – 29 IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email Analysed #230328 Valid Insecure Direct Object Reference Medium 2017-09-16 – 29 External storage - global credentials returned to the client side in plaintext Analysed #2554079 Valid Information Disclosure Medium 2024-11-21 – 28 Non-admin users can reset app allowlist to the default Analysed #2250398 Valid Input Validation and Logic Medium 2024-01-18 – 28 user_ldap app logs user passwords in the log file on level debug Analysed #2101165 Valid Cryptography Medium 2023-11-21 – 28 Blind Stored XSS on iOS App due to Unsanitized Webview Analysed #575562 Valid Cross-site Scripting Low 2020-03-07 $100 28 Reflected XSS in error pages (NC-SA-2017-008) Analysed #216812 Valid Cross-site Scripting Low 2017-05-15 $450 28 Participants were able to blindly delete poll drafts of other users by ID Analysed #3247386 Valid Insecure Direct Object Reference Medium 2025-12-05 – 27 X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted files Analysed #2597504 Valid Cryptography Medium 2024-12-15 – 27 Password of talk conversations can be bruteforced Analysed #2094473 Valid Authentication Medium 2023-11-12 – 27 Profile of disabled user stays accessible Analysed #1675014 Valid Access Control Low 2022-11-26 $100 27 SMTP Command Injection in Appointment Emails via Newlines Analysed #1509216 Valid Injection and Smuggling Medium 2022-12-27 – 27 CSRF vulnerability that allows an attacker to modify encryption settings Analysed #630146 Valid Cross-Site Request Forgery Low 2019-12-07 – 27 SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent Analysed #3590576 Valid File and Path Handling Medium 2026-04-20 – 26 XSS in PDF Viewer Analysed #819863 Valid Cross-site Scripting Low 2020-05-23 $100 26 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables Analysed #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 Predictable proposal participant tokens enable unauthorized access and vote submission Analysed #3385434 Valid Cryptography Low 2026-01-04 $100 25 Event create can create attachments that link to other websites Analysed #2457588 Valid Open Redirect Medium 2024-07-14 $250 25 CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link Analysed #1741430 Valid Cross-Site Request Forgery Medium 2023-01-11 – 25 Cards in Deck are readable by any user Analysed #1331728 Valid Information Disclosure Medium 2023-03-26 – 25 Leak arbitrary file under nextcloud android client privacy directory Analysed #1142918 Valid No weakness recorded Medium 2021-07-17 – 25 https://help.nextcloud.com::: Web cache poisoning attack Analysed #429747 Valid No weakness recorded High 2020-01-31 – 25 Nextcloud Tables app - inserting rows to an arbitrary table possible Analysed #2671404 Valid No weakness recorded Medium 2024-11-17 – 24 Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4 Analysed #2290680 Valid Access Control Medium 2024-07-14 $500 24 Missing brute force protection on password confirmation modal Analysed #1842114 Valid Authentication Medium 2023-03-21 – 24 Error in Booking an appointment reveals the full path of the website Analysed #1841408 Valid Access Control Low 2023-06-18 – 24 Bypass of privacy filter / tracking pixel blocker Analysed #1215251 Valid Information Disclosure Medium 2021-08-11 $100 24 Unrestricted file upload on the image of contacts Analysed #808287 Valid Input Validation and Logic Low 2020-07-08 $100 24