Disabled download shares still allow download through preview images Analysed #1745766 Valid Access Control Low 2022-12-31 – 18 Folder architecture and Filesizes of private file drop shares can be getten Analysed #1337422 Valid Information Disclosure Medium 2022-04-09 – 18 Clients do not verify server public key Analysed #1192470 Valid No weakness recorded Low 2021-09-23 $250 18 SSRF protection bypass Analysed #736867 Valid Server-Side Request Forgery Medium 2020-03-14 $100 18 Registered users can change app password permissions for any user Analysed #297751 Valid Insecure Direct Object Reference Low 2018-02-08 $100 18 Log pollution can lead to HTML Injection. Analysed #146278 Valid Cross-site Scripting – 2016-07-19 – 18 Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11 Analysed #145392 Valid Misconfiguration and Insecure Design – 2016-08-17 – 18 SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards Analysed #3576823 Valid Server-Side Request Forgery Medium 2026-10-27 $250 17 FederationController::remoteWopiToken() returns full Wopi entity without token type validation #3568116 Valid Access Control Low 2026-10-27 – 17 Users can set up workflows using restricted and invisible system tags Analysed #1895976 Valid Access Control Medium 2023-05-17 – 17 Missing brute force protection for passwords of password protected share links Analysed #1894653 Valid Authentication Low 2023-04-25 – 17 Chat room member disclosure via autocomplete API Analysed #1850407 Valid Access Control Medium 2023-03-25 – 17 Suspicious login app ships old league/flysystem version Analysed #1720822 Valid Misconfiguration and Insecure Design – 2023-02-08 – 17 Missing rate limiting on password reset functionality allows to send lot of emails Analysed #1691195 Valid Access Control Low 2023-03-05 $100 17 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" Analysed #1595006 Valid Server-Side Request Forgery Medium 2022-09-03 $250 17 Password disclosure in initial setup of Mail App Analysed #1561471 Valid Cryptography Low 2022-09-03 – 17 Ransomware protection is missing extentions take 2 Analysed #1200785 Valid No weakness recorded Low 2021-07-16 $100 17 public webdav endpoint not bruteforce protected Analysed #1192159 Valid No weakness recorded Low 2021-08-11 $100 17 Reflected XSS when renaming a file with a vulnerable name which results in an error Analysed #896522 Valid Cross-site Scripting Medium 2021-03-01 $100 17 XSS in desktop client via invalid server address on login form Analysed #685552 Valid Cross-site Scripting Medium 2020-08-17 – 17 User with read-only access to a share can gain write access to sub-folders in the share Analysed #619484 Valid Access Control Medium 2020-03-01 – 17 Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color` Analysed #605915 Valid Cross-site Scripting Medium 2019-08-29 – 17 xmlrpc.php is enabled - Nextcloud Analysed #458696 Valid Access Control Medium 2020-03-01 – 17 Access control issue -- [Allow file system access not validated when using session auth] Analysed #388515 Valid Access Control Medium 2018-09-25 $100 17 Activity app does not verify federated file activity received from remote servers Analysed #3534050 Valid Authentication Low 2026-09-05 $150 16 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders Analysed #3506873 Valid Access Control Medium 2026-09-17 – 16 Error when editing a calendar appointment returns stacktrace and query Analysed #2108342 Valid Information Disclosure Medium 2024-01-17 – 16 Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log] Analysed #1767439 Valid Information Disclosure Low 2022-12-15 – 16 HEIC image preview can be used to invoke Imagick Analysed #1261413 Valid Information Disclosure Critical 2023-01-07 – 16 Possible denial of service when entering a loooong password Analysed #952349 Valid Authentication Medium 2020-09-16 – 16 No rate limiting on sinup page Analysed #922470 Valid Input Validation and Logic Low 2020-09-28 – 16 Missing server side controls when editing the board’s sharing permissions per user Analysed #827816 Valid Access Control High 2020-09-28 – 16 Docker image with FPM is vulnerable to CVE-2019-11043 Analysed #720306 Valid Command and Code Injection Critical 2020-03-14 $100 16 DOM XSS vulnerability in search dialogue (NC-SA-2017-007) Analysed #213227 Valid Cross-site Scripting Low 2017-06-07 $250 16 Android - Possible to intercept broadcasts about uploaded files Analysed #167481 Valid Information Disclosure – 2017-03-23 – 16 Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections Analysed #3303283 Valid Server-Side Request Forgery Medium 2026-09-17 – 15 Stored XSS in contacts app via organisation and title field Analysed #3293290 Valid Cross-site Scripting Low 2026-01-04 $100 15 Twitter Account hijack @nextcloudfrance Analysed #1916565 Valid No weakness recorded Medium 2023-03-30 – 15 Responsive Server-side Request Forgery (SSRF) Analysed #1895874 Valid Server-Side Request Forgery Medium 2023-10-19 – 15 Messages can still be seen on conversation after expiring when cron is misconfigured Analysed #1784310 Valid Information Disclosure Low 2023-02-27 – 15 Guests can continue to receive video streams from call after being removed from a conversation Analysed #1706248 Valid Information Disclosure Medium 2022-12-31 – 15 File drop public link can also be converted to federated share Analysed #1167929 Valid Access Control Low 2021-06-10 $500 15 Take over a mail account due missing validation of account id Analysed #1094063 Valid Access Control Medium 2021-06-01 – 15 Access Control: Inject tasks into other users decks Analysed #867052 Valid Access Control Medium 2021-02-02 – 15 Exposing debug.log file leads to server full path disclosure Analysed #696360 Valid Information Disclosure Low 2019-10-17 – 15 Non-admin users can trigger writes to memcached by entering a malicious server as a share URL Analysed #592864 Valid Injection and Smuggling Medium 2020-07-09 $100 15 Blind SSRF as normal user from mailapp Analysed #1913095 Valid Server-Side Request Forgery Low 2023-05-30 – 14 Reference caching can leak data to unauthorized users Analysed #1767503 Valid Information Disclosure Medium 2023-01-13 – 14 bypass forced password protection via circles app Analysed #1406926 Valid Input Validation and Logic Low 2022-06-19 $100 14 Virtual Data Room / Hide download on collabora is easy to bypass Analysed #1194606 Valid Access Control High 2021-08-07 $150 14