Access Control: Inject tasks into other users decks #867052 Valid Access Control Medium 2021-02-02 – 15 Exposing debug.log file leads to server full path disclosure #696360 Valid Information Disclosure Low 2019-10-17 – 15 Non-admin users can trigger writes to memcached by entering a malicious server as a share URL #592864 Valid Injection and Smuggling Medium 2020-07-09 $100 15 Email Spoofing Vulnerability from nextcloud. #229599 Spam No weakness recorded – 2017-05-18 – 15 Blind SSRF as normal user from mailapp #1913095 Valid Server-Side Request Forgery Low 2023-05-30 – 14 Reference caching can leak data to unauthorized users #1767503 Valid Information Disclosure Medium 2023-01-13 – 14 bypass forced password protection via circles app #1406926 Valid Input Validation and Logic Low 2022-06-19 $100 14 Virtual Data Room / Hide download on collabora is easy to bypass #1194606 Valid Access Control High 2021-08-07 $150 14 Android app does not clear end to end encryption keys #1189168 Valid No weakness recorded Low 2021-06-16 $100 14 Content Spoofing /Text Injection in https://docs.nextcloud.com #666557 Valid Misconfiguration and Insecure Design Low 2019-09-05 – 14 Delete permission can be added on reshare #633245 Valid Access Control Low 2019-09-03 – 14 Linux client is vulnerable to directory traversal when downloading files #590319 Valid File and Path Handling Medium 2020-08-17 $250 14 Combination of content provider allows private data disclosure #534541 Valid Access Control Low 2019-07-26 $100 14 Nextcloud domain and name of every user leaked to lookup server #508490 Valid Information Disclosure Medium 2019-11-26 – 14 Stored XSS in OAuth redirect URI #261138 Valid Cross-site Scripting – 2019-05-11 – 14 Unauthenticated Stored xss #168054 N/A Cross-site Scripting – 2016-09-13 – 14 Nextcloud 10.0 privilege escalation issue - Normal user can mask external storage shared by admin #165229 Valid Access Control – 2020-03-01 – 14 Nextcloud Tables v1 Share Enumeration Without Authorization (Regression of CVE-2024-52507) #3334165 Valid Authentication Low 2025-12-05 – 13 Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle #1893186 Valid Cross-site Scripting Medium 2023-05-15 – 13 Mail app - blind SSRF via imapHost parameter #1736390 Valid Server-Side Request Forgery Low 2023-02-06 – 13 Secure view trivial to bypass #1724021 Valid Access Control Medium 2023-03-30 $150 13 Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link #1720043 Valid Command and Code Injection Medium 2023-02-10 – 13 Database resource exhaustion for logged-in users via sharee recommendations with circles #1688199 Valid Denial of Service Medium 2022-11-26 $250 13 Desktop client does not verify received singed certificate in end to end encryption #1679267 Valid Cryptography Medium 2023-04-27 $1,000 13 Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board #1450117 Valid Insecure Direct Object Reference Medium 2022-05-20 – 13 End to end encryption public key is not properly verified on Desktop and Android #1189162 Valid No weakness recorded Medium 2021-09-23 $1,500 13 Stored XSS in markdown file with Nextcloud Talk using Internet Explorer #1023787 Valid Cross-site Scripting Low 2021-02-19 – 13 Only the file extensions are checked, not the MIME types as configured #697959 Valid No weakness recorded Medium 2020-03-14 – 13 Bypassing lock protection #490946 Valid Authentication Low 2019-07-26 $50 13 Talk / spreed: Disclosure of Room names and participants for password protected rooms #428010 Valid Information Disclosure Medium 2019-04-17 $50 13 Content Spoofing/Text Injection in https://demo.nextcloud.com #222058 Valid Misconfiguration and Insecure Design – 2017-04-28 – 13 Design Issues on ( ███ ) Lead to show ( IPS of Users ) #218733 Valid No weakness recorded – 2017-04-05 – 13 Cross-room signaling injection enabling unauthorized force-mute #3636758 Valid Authentication Low 2026-10-21 – 12 Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API #3524971 Valid Information Disclosure Low 2026-10-27 – 12 Text does not respect 'Allow download' permissions #1965156 Valid Access Control Low 2023-08-23 $250 12 No password length restriction in reset password endpoint #1820864 Valid Denial of Service Low 2023-02-09 – 12 Mail app stores cleartext password in database until OAUTH2 setup is done #1806275 Valid Authentication Low 2023-03-08 – 12 Information exposure in in guzzlehttp/guzzle (https://github.com/nextcloud/3rdparty/tree/master/guzzlehttp/guzzle) #1604606 Valid Information Disclosure Low 2022-09-16 – 12 Lack of Brute force protection while joining video call in talk section which is password protected #1596673 Valid Information Disclosure Low 2022-08-08 – 12 Missing character limitation allows to put generate a database error #1596059 Valid Denial of Service Low 2023-01-09 – 12 Missing length validation of user displayname allows to generate an SQL error #1588562 Valid Denial of Service Low 2022-12-20 – 12 Access to arbitrary file of the Nextcloud Android app from within the Nextcloud Android app #1408692 Valid File and Path Handling Low 2022-09-11 $250 12 Federated share accepting/declining is not logged in audit log #1200815 Valid Input Validation and Logic Low 2022-09-03 – 12 Trusted servers exchange can be triggered by attacker #1167853 Valid Access Control Medium 2021-06-10 $750 12 XSS in image metadata field #896511 Valid Cross-site Scripting Medium 2020-08-05 – 12 Able to bypass "Device credentials" Lock #507172 Valid Access Control Low 2019-07-26 – 12 Predictable Random Number Generator #504731 Informative Cryptography Medium 2019-06-26 – 12 Remote attacker can impersonate Social users via ActivityPub API #461308 Valid Deserialization and Object Injection – 2019-02-01 – 12 https://portal.nextcloud.com/.htaccess file is readable #220946 Valid Information Disclosure – 2017-04-14 – 12 Wordpress 4.7.1 #201489 Valid No weakness recorded – 2017-01-27 – 12