Stored XSS on Share-popup of a directory's Gallery-view Analysed #145355 Valid Cross-site Scripting – 2016-07-19 – 24 SMTP header injection via C-escape `\r` in the recipient display name Analysed #3913007 Valid Memory Corruption None 2026-10-18 – 23 Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app Analysed #3521639 Valid Memory Corruption Low 2026-09-05 – 23 Cross-User Lock/Unlock via Absolute DAV Path Analysed #3301553 Valid Authentication Medium 2026-09-17 – 23 User scoped external storage can be used to gather credentials of other users Analysed #1978882 Valid Input Validation and Logic High 2023-06-27 – 23 Improper restriction of excessive authentication attempts on WebDAV endpoint Analysed #1924212 Valid Authentication Medium 2023-08-10 – 23 Session fixation on public talk links Analysed #1181962 Valid Authentication Medium 2021-06-16 $100 23 Ratelimiting can be bypassed using IPv6 subnets Analysed #1154003 Valid Authentication Low 2021-07-01 – 23 Possible denial of service when entering a loooong password Analysed #840598 Valid Authentication Medium 2020-07-29 $100 23 Persistent XSS via filename in projects Analysed #662204 Valid Cross-site Scripting Low 2020-03-01 $150 23 Calendar attachments of local files are offered to downloaded Analysed #3112033 Valid Input Validation and Logic Medium 2025-12-05 – 22 Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist Analysed #2251074 Valid Injection and Smuggling Medium 2024-01-18 – 22 SMTP Command Injection in iCalendar Attachments to Emails via Newlines Analysed #1516377 Valid Injection and Smuggling Medium 2022-07-04 – 22 Lack of bruteforce protection for TOTP 2FA Analysed #1265709 Valid Authentication Medium 2023-03-26 $750 22 XSS through image upload of contacts using svg file Analysed #894876 Valid Cross-site Scripting Low 2020-12-17 $100 22 "Secure View" aka "Hide Download" can be bypassed easily Analysed #788257 Valid Access Control High 2020-04-10 – 22 Gallery: No feedback for invalid password Analysed #428660 Valid Input Validation and Logic Low 2019-07-27 $50 22 Deck app: Invalid tag color is accepted by API and breaks frontend UI Analysed #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Open redirect in user_saml via RelayState parameter Analysed #2263044 Valid Open Redirect Low 2024-01-18 – 21 Full Passcode bypass on Nextcloud App iOS Analysed #1847368 Valid Access Control Low 2023-04-10 – 21 Possibility to delete files attached to deck cards of other users Analysed #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Notification implicit PendingIntent in com.nextcloud.client allows to access contacts Analysed #1161401 Valid Information Disclosure Low 2022-05-27 $250 21 XSS through image upload of contacts using svg file with png extension Analysed #998422 Valid Cross-site Scripting Low 2020-12-26 – 21 Missing Duplicate Check allowing Multiple Retention Rules per System Tag Analysed #3521646 Valid Input Validation and Logic Low 2026-09-05 – 20 Users can modify tags on files that do not belong to them Analysed #3040887 Valid Access Control Medium 2026-01-04 $150 20 Self XSS when pasting HTML into Text app with Ctrl+Shift+V Analysed #2211561 Valid Cross-site Scripting Medium 2023-12-21 – 20 Self XSS when sending HTML as a comment in the Deck app Analysed #2058556 Valid Cross-site Scripting None 2024-01-18 – 20 [user_oidc] Unencrypted Communications Analysed #1687005 Valid Cryptography Low 2022-12-18 – 20 Missing brute force protection on OAuth2 API controller Analysed #1258448 Valid Authentication Medium 2023-08-10 $500 20 Sensitive files/ data exists post deletion of user account Analysed #1222873 Valid Access Control Low 2022-05-20 – 20 Access control missing while viewing the attachments in the "All boards" Analysed #916704 Valid Insecure Direct Object Reference Medium 2020-09-29 $150 20 Denial of Service by requesting to reset a password Analysed #812754 Valid Denial of Service High 2021-01-25 – 20 Username and Access Token Disclousure Analysed #672623 Valid Misconfiguration and Insecure Design Low 2020-03-01 $250 20 OAuth2 Access Token and App Password Security Vulnerability Analysed #343111 Valid Cryptography Medium 2018-07-21 – 20 bypass of 2FA Analysed #248656 Valid Authentication High 2018-07-29 $750 20 Session fixation in password protected public download. Analysed #237184 Valid Authentication Low 2018-10-25 – 20 https://xmpp.nextcloud.com///;@www.google.com allows open redirect Analysed #211213 Valid Open Redirect – 2017-08-13 – 20 Persistent SMTP header injection via identity `organization` / `name` Analysed #3913012 Valid Memory Corruption None 2026-09-18 – 19 Team membership information returned on API level based on ID Analysed #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Deck app allows to spoof file extensions by using RTLO characters Analysed #2326618 Valid No weakness recorded Medium 2026-01-04 $100 19 Memcached used as RateLimiter backend is no-op Analysed #2110945 Valid Authentication Medium 2023-11-12 – 19 Missing permission check when removing a photo from an album Analysed #1946298 Valid Access Control Low 2024-07-14 – 19 [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only Analysed #1687410 Valid Cross-site Scripting Low 2022-12-18 – 19 Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate Analysed #1596459 Valid Access Control Low 2022-12-25 – 19 When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL Analysed #1358977 Valid Input Validation and Logic Medium 2022-02-15 – 19 SQLi allow query restriction bypass on exposed FileContentProvider Analysed #518669 Valid SQL Injection Low 2019-07-29 $100 19 Authentication Issue Analysed #146133 Valid Authentication – 2018-10-25 $50 19 Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider Analysed #3696266 Valid File and Path Handling Medium 2026-08-24 – 18 see card comments after remove shared board Analysed #2289333 Valid Access Control Medium 2024-06-18 – 18 App pin of the Android app can be bypassed via 3rdparty apps generating deep links Analysed #1825679 Valid Authentication Low 2023-05-04 – 18