Nextcloud Tables app - inserting rows to an arbitrary table possible #2671404 Valid No weakness recorded Medium 2024-11-17 – 24 Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4 #2290680 Valid Access Control Medium 2024-07-14 $500 24 Missing brute force protection on password confirmation modal #1842114 Valid Authentication Medium 2023-03-21 – 24 Error in Booking an appointment reveals the full path of the website #1841408 Valid Access Control Low 2023-06-18 – 24 Bypass of privacy filter / tracking pixel blocker #1215251 Valid Information Disclosure Medium 2021-08-11 $100 24 Unrestricted file upload on the image of contacts #808287 Valid Input Validation and Logic – 2020-07-08 $100 24 Stored XSS on Share-popup of a directory's Gallery-view #145355 Valid Cross-site Scripting – 2016-07-19 – 24 SMTP header injection via C-escape `\r` in the recipient display name #3913007 Valid Memory Corruption None 2026-10-18 – 23 Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app #3521639 Valid Memory Corruption Low 2026-09-05 – 23 Cross-User Lock/Unlock via Absolute DAV Path #3301553 Valid Authentication Medium 2026-09-17 – 23 User scoped external storage can be used to gather credentials of other users #1978882 Valid Input Validation and Logic High 2023-06-27 – 23 Improper restriction of excessive authentication attempts on WebDAV endpoint #1924212 Valid Authentication Medium 2023-08-10 – 23 Session fixation on public talk links #1181962 Valid Authentication Medium 2021-06-16 $100 23 Ratelimiting can be bypassed using IPv6 subnets #1154003 Valid Authentication Low 2021-07-01 – 23 Possible denial of service when entering a loooong password #840598 Valid Authentication – 2020-07-29 $100 23 Persistent XSS via filename in projects #662204 Valid Cross-site Scripting – 2020-03-01 $150 23 Calendar attachments of local files are offered to downloaded #3112033 Valid Input Validation and Logic Medium 2025-12-05 – 22 Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist #2251074 Valid Injection and Smuggling Medium 2024-01-18 – 22 SMTP Command Injection in iCalendar Attachments to Emails via Newlines #1516377 Valid Injection and Smuggling Medium 2022-07-04 – 22 Lack of bruteforce protection for TOTP 2FA #1265709 Valid Authentication Medium 2023-03-26 $750 22 XSS through image upload of contacts using svg file #894876 Valid Cross-site Scripting Low 2020-12-17 $100 22 "Secure View" aka "Hide Download" can be bypassed easily #788257 Valid Access Control – 2020-04-10 – 22 Gallery: No feedback for invalid password #428660 Valid Input Validation and Logic – 2019-07-27 $50 22 Deck app: Invalid tag color is accepted by API and breaks frontend UI #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Open redirect in user_saml via RelayState parameter #2263044 Valid Open Redirect Low 2024-01-18 – 21 Full Passcode bypass on Nextcloud App iOS #1847368 Valid Access Control Low 2023-04-10 – 21 Possibility to delete files attached to deck cards of other users #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Notification implicit PendingIntent in com.nextcloud.client allows to access contacts #1161401 Valid Information Disclosure Low 2022-05-27 $250 21 XSS through image upload of contacts using svg file with png extension #998422 Valid Cross-site Scripting Low 2020-12-26 – 21 Missing Duplicate Check allowing Multiple Retention Rules per System Tag #3521646 Valid Input Validation and Logic Low 2026-09-05 – 20 Users can modify tags on files that do not belong to them #3040887 Valid Access Control Medium 2026-01-04 $150 20 Self XSS when pasting HTML into Text app with Ctrl+Shift+V #2211561 Valid Cross-site Scripting Medium 2023-12-21 – 20 Self XSS when sending HTML as a comment in the Deck app #2058556 Valid Cross-site Scripting None 2024-01-18 – 20 [user_oidc] Unencrypted Communications #1687005 Valid Cryptography Low 2022-12-18 – 20 Missing brute force protection on OAuth2 API controller #1258448 Valid Authentication Medium 2023-08-10 $500 20 Sensitive files/ data exists post deletion of user account #1222873 Valid Access Control Low 2022-05-20 – 20 Access control missing while viewing the attachments in the "All boards" #916704 Valid Insecure Direct Object Reference Medium 2020-09-29 $150 20 Denial of Service by requesting to reset a password #812754 Valid Denial of Service – 2021-01-25 – 20 Username and Access Token Disclousure #672623 Valid Misconfiguration and Insecure Design – 2020-03-01 $250 20 OAuth2 Access Token and App Password Security Vulnerability #343111 Valid Cryptography – 2018-07-21 – 20 bypass of 2FA #248656 Valid Authentication – 2018-07-29 $750 20 Session fixation in password protected public download. #237184 Valid Authentication – 2018-10-25 – 20 https://xmpp.nextcloud.com///;@www.google.com allows open redirect #211213 Valid Open Redirect – 2017-08-13 – 20 Persistent SMTP header injection via identity `organization` / `name` #3913012 Valid Memory Corruption None 2026-09-18 – 19 Team membership information returned on API level based on ID #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Deck app allows to spoof file extensions by using RTLO characters #2326618 Valid No weakness recorded Medium 2026-01-04 $100 19 Memcached used as RateLimiter backend is no-op #2110945 Valid Authentication Medium 2023-11-12 – 19 Missing permission check when removing a photo from an album #1946298 Valid Access Control Low 2024-07-14 – 19 [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only #1687410 Valid Cross-site Scripting Low 2022-12-18 – 19 Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate #1596459 Valid Access Control Low 2022-12-25 – 19