Code injection possible with malformed Nextcloud Talk chat commands Analysed #851807 Valid Command and Code Injection High 2020-06-02 – 317 Attacker can obtain write access to any federated share/public link Analysed #1170024 Valid Authentication High 2021-06-10 $4,000 142 Missing ownership check on remote wipe endpoint Analysed #819807 Valid Insecure Direct Object Reference High 2020-04-19 $500 141 Remote Code Execution via Extract App Plugin Analysed #546753 Valid Command and Code Injection High 2019-05-30 – 124 SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution Analysed #3462991 Valid SQL Injection High 2026-05-15 – 80 Two-factor authentication enforcement bypass Analysed #1050244 Valid No weakness recorded High 2021-07-31 $750 64 Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC Analysed #3489490 Valid Authentication High 2026-06-07 $2,500 55 Basic auth header on WebDAV requests is not bruteforce protected Analysed #1879549 Valid Authentication High 2023-06-02 – 53 Password reset endpoint is not brute force protected Analysed #1987062 Valid Authentication High 2023-07-21 $500 46 Delete external storage of any user Analysed #2212627 Valid Access Control High 2023-11-21 – 45 End-to-end encrypted file-drops can be made inaccessible Analysed #1914115 Valid Access Control High 2023-06-22 $400 43 Remote code execution via path traversal in Zip extraction in the Extract app Analysed #765291 Valid File and Path Handling High 2020-03-07 – 40 Scoped apptokens can be changed by that very apptoken Analysed #1193321 Valid Access Control High 2021-07-15 $1,000 39 Arbitrary read of all SVG files on a Nextcloud server Analysed #1302155 Valid File and Path Handling High 2023-03-26 $1,250 36 Mail auto configurator can be tricked into sending account information to wrong servers Analysed #2508422 Valid Information Disclosure High 2024-11-15 $100 34 Can reshare read&share only folder with more permissions #2289425 Valid Access Control High 2024-07-14 $750 32 Group admins can remove arbitrary data from "data" directory (including admin data) #508493 Valid Access Control High 2019-08-12 – 32 https://help.nextcloud.com::: Web cache poisoning attack #429747 Valid No weakness recorded High 2020-01-31 – 25 User scoped external storage can be used to gather credentials of other users #1978882 Valid Input Validation and Logic High 2023-06-27 – 23 "Secure View" aka "Hide Download" can be bypassed easily #788257 Valid Access Control High 2020-04-10 – 22 Denial of Service by requesting to reset a password #812754 Valid Denial of Service High 2021-01-25 – 20 bypass of 2FA #248656 Valid Authentication High 2018-07-29 $750 20 Missing server side controls when editing the board’s sharing permissions per user #827816 Valid Access Control High 2020-09-28 – 16 Email Spoofing Vulnerability from nextcloud. #229599 Spam No weakness recorded High 2017-05-18 – 15 Virtual Data Room / Hide download on collabora is easy to bypass #1194606 Valid Access Control High 2021-08-07 $150 14 New AppPassword can be generated without password confirmation #2067572 Valid Access Control High 2023-08-10 $250 11 In Dockerized Environments, Failing to Read config.php Grants Any Anonymous User Full Admin Access #522876 Valid Access Control High 2019-07-27 – 11 User Editable nextcloud Wiki pages of Public Repositories #498878 Valid No weakness recorded High 2019-08-31 – 11 SQL injextion via vulnerable doctrine/dbal version #1390331 Valid SQL Injection High 2022-05-11 – 10 Reflected XSS in U2F plugin by shipping the example endpoints #192786 Valid Cross-site Scripting High 2017-03-22 – 10 Password of failed (2FA) login attempt is stored in log #244092 Valid Authentication High 2020-03-01 – 9 Privilege escalation - Normal user can somehow make admin to delete shared folders #166581 Valid Access Control High 2017-05-20 – 9 Acting under any different user via DB-stored credentials #1061591 Valid Access Control High 2021-03-01 – 8 Wordpress Users Disclosure #625199 Duplicate Information Disclosure High 2019-07-01 – 8 bypassing dashboard without account + Information disclosure trough websockets #1102780 Informative Access Control High 2021-04-20 – 6 Recently change email but still login with old email #986459 Informative Authentication High 2020-09-29 – 6 nextcloud-snap CircleCI project has vulnerable configuration which can lead to exposing secrets #794407 Valid Authentication High 2021-01-29 – 6 potential RCE and XSS via file upload requiring user account and default settings #678727 Valid Command and Code Injection High 2020-04-01 – 5 Version 4.7.2 of wordpress is vulnerable #211206 Valid No weakness recorded High 2017-03-07 – 5 DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data. #1147611 Valid Denial of Service High 2021-06-01 – 4 Nextcloud Server Remote Command Execution #226896 N/A No weakness recorded High 2017-05-10 – 4 Stored XSS on new Calling plugin (spreed) #190870 Valid Cross-site Scripting High 2016-12-13 – 4 Unauthenticated Persistent Denial-of-Service via Federated Share Injection #3679640 Valid Denial of Service High 2026-10-27 – 3 External storage app saves password for all users in the database #867164 Valid Authentication High 2021-03-01 – 3 Bruteforce in admin panel #341074 Valid Authentication High 2020-01-31 – 3 ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service) #237860 Valid Denial of Service High 2017-06-08 – 3 Improper integrity protection of server-side encryption keys #732431 Valid Authentication High 2020-11-13 – 2 BruteForce in to Admin Account #188205 Informative Authentication High 2016-12-04 – 2 Bypass hide download Nextcloud Share #865777 Informative Input Validation and Logic High 2020-10-05 – 1