Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/ Analysed #2946927 Valid No weakness recorded Low 2025-03-16 – 113 View-only guests could see deleted Collectives pages in the trashbin Analysed #3521434 Valid Access Control Low 2026-05-08 – 87 Private circle can be added to another circle via API despite visibility restriction Analysed #3511998 Valid Insecure Direct Object Reference Low 2026-05-08 $150 87 WebAuthn app was updated based on public key Analysed #3360354 Valid Insecure Direct Object Reference Low 2026-02-06 – 84 Improper input validation in emoji field leads to sidebar UI denial of service Analysed #3599470 Valid Input Validation and Logic Low 2026-09-20 – 64 Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Analysed #3304830 Valid Insecure Direct Object Reference Low 2026-05-08 – 60 Default Nextcloud Server and Android Client leak sharee searches to Nextcloud Analysed #1167916 Valid Access Control Low 2021-06-15 $750 58 Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lock Analysed #331489 Valid Information Disclosure Low 2019-07-26 – 58 Calendar app allowed booking appointments without the generated token Analysed #3275810 Valid Insecure Direct Object Reference Low 2025-12-05 – 57 Clear text storage of proxy parameters and passwords Analysed #685990 Valid Cryptography Low 2020-09-16 – 53 XSS in Desktop Client in the notifications Analysed #1668028 Valid Cross-site Scripting Low 2022-11-25 $750 50 Stored XSS in collabora via user name Analysed #968232 Valid Cross-site Scripting Low 2020-09-19 – 48 Can download files on Android app without permission Analysed #2380133 Valid Access Control Low 2026-01-16 $250 47 Events information leaked with shared calendars on recurrence exceptions Analysed #2479325 Valid Information Disclosure Low 2024-06-14 $100 45 OAuth2 "authorization_code" is valid indefinetly Analysed #1784162 Valid Misconfiguration and Insecure Design Low 2024-02-17 $100 45 Blind SSRF Vulnerability in Appstore Release Upload Form Analysed #2925666 Valid Access Control Low 2025-01-14 – 43 Email not verified when changing afterwards on apps.nextcloud.com Analysed #2305880 Valid Misconfiguration and Insecure Design Low 2025-09-29 – 42 No password length limit when creating a user as an administrator Analysed #1727424 Valid Denial of Service Low 2022-12-31 – 39 Blind SSRF in Mail App Analysed #1869714 Valid Server-Side Request Forgery Low 2024-01-10 – 37 [Reflected XSS] In Request URL Analysed #515484 Valid Cross-site Scripting Low 2020-03-01 – 37 SQL Injection found in NextCloud Android App Content Provider Analysed #291764 Valid SQL Injection Low 2019-07-26 $150 36 Email Enumeration via Password-Protected Share Identity Verification Analysed #3507273 Valid Information Disclosure Low 2026-09-05 $100 35 App PIN code can be bypassed in Files iOS Analysed #2245437 Valid Authentication Low 2023-12-18 $100 33 Share information of Tables app is not limited to affected users Analysed #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 Admins can change authentication details of user configured external storage Analysed #2107934 Valid Access Control Low 2023-12-21 $100 31 HTML injection in search UI when selecting a circle with HTML in the display name Analysed #2210038 Valid Cross-site Scripting Low 2023-11-21 – 30 Passcode bypass on Talk Android app Analysed #1784645 Valid Access Control Low 2023-01-09 – 30 SSRF via potential filter bypass with too lax local domain checking Analysed #1608039 Valid Server-Side Request Forgery Low 2022-09-16 $250 30 Passwords being stored as plain text in logging Analysed #469668 Valid Cryptography Low 2019-08-31 – 30 Possible to enumerate valid files in password protected shares/files drop shares as well as spam folder with files Analysed #2376909 Valid Information Disclosure Low 2025-02-21 – 29 Attachments folder for Text app is accessible on Files Drop/Password protected shares Analysed #2376900 Valid Information Disclosure Low 2024-11-15 – 29 Nextcloud mail does not respect download permissions in shares Analysed #1878255 Valid Access Control Low 2024-12-15 $250 29 Code injection in macOS Desktop Client Analysed #633266 Valid Command and Code Injection Low 2020-04-10 – 29 Blind Stored XSS on iOS App due to Unsanitized Webview Analysed #575562 Valid Cross-site Scripting Low 2020-03-07 $100 28 Reflected XSS in error pages (NC-SA-2017-008) Analysed #216812 Valid Cross-site Scripting Low 2017-05-15 $450 28 Profile of disabled user stays accessible Analysed #1675014 Valid Access Control Low 2022-11-26 $100 27 CSRF vulnerability that allows an attacker to modify encryption settings Analysed #630146 Valid Cross-Site Request Forgery Low 2019-12-07 – 27 XSS in PDF Viewer Analysed #819863 Valid Cross-site Scripting Low 2020-05-23 $100 26 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables Analysed #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 Predictable proposal participant tokens enable unauthorized access and vote submission Analysed #3385434 Valid Cryptography Low 2026-01-04 $100 25 Error in Booking an appointment reveals the full path of the website Analysed #1841408 Valid Access Control Low 2023-06-18 – 24 Unrestricted file upload on the image of contacts Analysed #808287 Valid Input Validation and Logic Low 2020-07-08 $100 24 Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app Analysed #3521639 Valid Memory Corruption Low 2026-09-05 – 23 Ratelimiting can be bypassed using IPv6 subnets Analysed #1154003 Valid Authentication Low 2021-07-01 – 23 Persistent XSS via filename in projects Analysed #662204 Valid Cross-site Scripting Low 2020-03-01 $150 23 XSS through image upload of contacts using svg file #894876 Valid Cross-site Scripting Low 2020-12-17 $100 22 Gallery: No feedback for invalid password #428660 Valid Input Validation and Logic Low 2019-07-27 $50 22 Deck app: Invalid tag color is accepted by API and breaks frontend UI #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Open redirect in user_saml via RelayState parameter #2263044 Valid Open Redirect Low 2024-01-18 – 21 Full Passcode bypass on Nextcloud App iOS #1847368 Valid Access Control Low 2023-04-10 – 21