When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL #1358977 Valid Input Validation and Logic Medium 2022-02-15 – 19 SQLi allow query restriction bypass on exposed FileContentProvider #518669 Valid SQL Injection – 2019-07-29 $100 19 Authentication Issue #146133 Valid Authentication – 2018-10-25 $50 19 Server side request forgery (SSRF) on nextcloud implementation. #145524 Informative No weakness recorded – 2016-06-17 – 19 Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider #3696266 Valid File and Path Handling Medium 2026-08-24 – 18 see card comments after remove shared board #2289333 Valid Access Control Medium 2024-06-18 – 18 App pin of the Android app can be bypassed via 3rdparty apps generating deep links #1825679 Valid Authentication Low 2023-05-04 – 18 Disabled download shares still allow download through preview images #1745766 Valid Access Control Low 2022-12-31 – 18 Folder architecture and Filesizes of private file drop shares can be getten #1337422 Valid Information Disclosure Medium 2022-04-09 – 18 Clients do not verify server public key #1192470 Valid No weakness recorded Low 2021-09-23 $250 18 SSRF protection bypass #736867 Valid Server-Side Request Forgery – 2020-03-14 $100 18 Registered users can change app password permissions for any user #297751 Valid Insecure Direct Object Reference – 2018-02-08 $100 18 Log pollution can lead to HTML Injection. #146278 Valid Cross-site Scripting – 2016-07-19 – 18 Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11 #145392 Valid Misconfiguration and Insecure Design – 2016-08-17 – 18 SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards #3576823 Valid Server-Side Request Forgery Medium 2026-10-27 $250 17 FederationController::remoteWopiToken() returns full Wopi entity without token type validation #3568116 Valid Access Control Low 2026-10-27 – 17 Users can set up workflows using restricted and invisible system tags #1895976 Valid Access Control Medium 2023-05-17 – 17 Missing brute force protection for passwords of password protected share links #1894653 Valid Authentication Low 2023-04-25 – 17 Chat room member disclosure via autocomplete API #1850407 Valid Access Control Medium 2023-03-25 – 17 Suspicious login app ships old league/flysystem version #1720822 Valid Misconfiguration and Insecure Design – 2023-02-08 – 17 Missing rate limiting on password reset functionality allows to send lot of emails #1691195 Valid Access Control Low 2023-03-05 $100 17 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" #1595006 Valid Server-Side Request Forgery Medium 2022-09-03 $250 17 Password disclosure in initial setup of Mail App #1561471 Valid Cryptography Low 2022-09-03 – 17 Ransomware protection is missing extentions take 2 #1200785 Valid No weakness recorded Low 2021-07-16 $100 17 public webdav endpoint not bruteforce protected #1192159 Valid No weakness recorded Low 2021-08-11 $100 17 Reflected XSS when renaming a file with a vulnerable name which results in an error #896522 Valid Cross-site Scripting Medium 2021-03-01 $100 17 XSS in desktop client via invalid server address on login form #685552 Valid Cross-site Scripting – 2020-08-17 – 17 User with read-only access to a share can gain write access to sub-folders in the share #619484 Valid Access Control – 2020-03-01 – 17 Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color` #605915 Valid Cross-site Scripting – 2019-08-29 – 17 xmlrpc.php is enabled - Nextcloud #458696 Valid Access Control – 2020-03-01 – 17 Access control issue -- [Allow file system access not validated when using session auth] #388515 Valid Access Control – 2018-09-25 $100 17 Activity app does not verify federated file activity received from remote servers #3534050 Valid Authentication Low 2026-09-05 $150 16 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders #3506873 Valid Access Control Medium 2026-09-17 – 16 Error when editing a calendar appointment returns stacktrace and query #2108342 Valid Information Disclosure Medium 2024-01-17 – 16 Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log] #1767439 Valid Information Disclosure Low 2022-12-15 – 16 HEIC image preview can be used to invoke Imagick #1261413 Valid Information Disclosure Critical 2023-01-07 – 16 Possible denial of service when entering a loooong password #952349 Valid Authentication Medium 2020-09-16 – 16 No rate limiting on sinup page #922470 Valid Input Validation and Logic Low 2020-09-28 – 16 Missing server side controls when editing the board’s sharing permissions per user #827816 Valid Access Control – 2020-09-28 – 16 Docker image with FPM is vulnerable to CVE-2019-11043 #720306 Valid Command and Code Injection – 2020-03-14 $100 16 DOM XSS vulnerability in search dialogue (NC-SA-2017-007) #213227 Valid Cross-site Scripting – 2017-06-07 $250 16 Android - Possible to intercept broadcasts about uploaded files #167481 Valid Information Disclosure – 2017-03-23 – 16 Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections #3303283 Valid Server-Side Request Forgery Medium 2026-09-17 – 15 Stored XSS in contacts app via organisation and title field #3293290 Valid Cross-site Scripting Low 2026-01-04 $100 15 Twitter Account hijack @nextcloudfrance #1916565 Valid No weakness recorded Medium 2023-03-30 – 15 Responsive Server-side Request Forgery (SSRF) #1895874 Valid Server-Side Request Forgery Medium 2023-10-19 – 15 Messages can still be seen on conversation after expiring when cron is misconfigured #1784310 Valid Information Disclosure Low 2023-02-27 – 15 Guests can continue to receive video streams from call after being removed from a conversation #1706248 Valid Information Disclosure Medium 2022-12-31 – 15 File drop public link can also be converted to federated share #1167929 Valid Access Control Low 2021-06-10 $500 15 Take over a mail account due missing validation of account id #1094063 Valid Access Control Medium 2021-06-01 – 15