PIN bypass in PassCodeActivity via back button #3625210 Valid Authentication Medium 2026-06-07 $150 101 Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope #3617729 Valid Information Disclosure Medium 2026-09-04 $250 101 Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId) #3572848 Valid Access Control Medium 2026-05-21 $150 100 Stored XSS Vulnerability via SVG File #3357808 Valid Cross-site Scripting Medium 2025-12-05 $150 79 CSRF protection on OIDC login is broken #1878381 Valid Cross-Site Request Forgery Medium 2023-04-04 $500 77 TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot #3799010 Valid Insecure Direct Object Reference Medium 2026-08-14 – 73 Directory Listing of publicly available assets #2311179 Valid Information Disclosure Medium 2025-09-29 – 70 ID4me feature of OpenID connect app available even when disabled #2376929 Valid Access Control Medium 2024-05-30 – 66 Valid share tokens allow to access tempory upload files of share owner #3483708 Valid Access Control Medium 2026-06-07 – 65 Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes #3610332 Valid Input Validation and Logic Medium 2026-09-17 $150 63 Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library #3249624 Valid File and Path Handling Medium 2025-10-16 – 63 Arbitrary Board Preference Injection via Deck Config API #3599383 Valid Access Control Medium 2026-09-17 $200 62 SVG filter primitives bypass remote image blocking, enabling email tracking without consent. #3486747 Valid Information Disclosure Medium 2026-04-20 – 53 Notes app can be tricked into using a received share created before the user logged in #2254151 Valid Input Validation and Logic Medium 2024-06-19 – 49 Download permissions can be changed by resharer #1724016 Valid Access Control Medium 2023-02-24 $500 49 SSRF via User-Controlled Push proxyServer in Notifications Push Registration #3623149 Valid Server-Side Request Forgery Medium 2026-09-30 – 48 Mail stored HTML injection in subject text #3357036 Valid No weakness recorded Medium 2026-02-12 – 48 Exposing debug.log file leads to server full path disclosure #2778441 Valid Input Validation and Logic Medium 2025-09-29 – 47 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 Inviting excessive long email addresses to a calendar event makes the server unresponsive #2058337 Valid Denial of Service Medium 2023-10-16 – 46 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays. #3590586 Valid Injection and Smuggling Medium 2026-04-20 – 44 User can copy locked folders and gain access to the contents #2447316 Valid Access Control Medium 2024-11-16 $500 44 Path traversal allows tricking the Talk Android app into writing files into it's root directory #1997029 Valid File and Path Handling Medium 2023-08-14 – 43 Can download files by zipping the folder #2247457 Valid Access Control Medium 2024-02-17 – 41 BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data #3382343 Informative Insecure Direct Object Reference Medium 2026-04-14 – 40 Stored XSS in attachment-display exploitable through SameSite #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 Approval app allows users to request approval for other users file #3338748 Valid Authentication Medium 2025-12-05 – 39 Unauthenticated testing endpoint of notify_push expose internal IP #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 Deck app allowed user with "Can share" permission to modify permissions of other non-owners #3247499 Valid Access Control Medium 2025-12-05 – 38 admin_audit does not log actions on files in a group folder #2890071 Valid Other weaknesses Medium 2025-12-05 – 38 Invisible Salamanders Attack against end_to_end_encryption in Nextcloud #2497947 Informative Cryptography Medium 2024-12-03 – 38 DNS pin middleware can be tricked into DNS rebinding allowing SSRF #2115212 Valid Server-Side Request Forgery Medium 2024-01-01 – 38 Read-only users can restore old versions #1356508 Valid Access Control Medium 2024-06-14 $500 38 Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute) #3400143 Valid Authentication Medium 2026-04-13 $250 37 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com #2446531 Valid Cryptography Medium 2024-05-22 – 37 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups #3674940 Valid Access Control Medium 2026-09-17 – 36 Unquoted body background attribute enables CSS injection that bypasses remote image blocking #3590583 Valid Injection and Smuggling Medium 2026-04-20 – 35 Incomplete sanitization in SVG preview provider #2484499 Valid Information Disclosure Medium 2024-12-15 $250 34 Brute force protection allows to send more requests than intended #1918525 Valid Authentication Medium 2023-07-13 $500 34 Ability to read any emails through IDOR on Nextcloud Mail #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 Bypass password confirmation via Context-dependent access control (CDCA) #2120667 Valid Access Control Medium 2024-01-17 $100 32 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet #3770482 Valid Access Control Medium 2026-09-18 – 31 Bruteforce protection in password verification can be bypassed #2230915 Valid Authentication Medium 2024-01-17 – 31 OAuth2 client_secret stored in plain text in the database #1994324 Valid Cryptography Medium 2023-11-15 $100 31 Tables app allowed users to view columns metadata information of any table #3138721 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Missing ownership check in Tables app allows moving columns into tables of other users #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Ability to by-pass second factor #2419776 Valid Authentication Medium 2024-07-14 $1,000 29 Enabling Birthday Contact to any user #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 ID4ME does not validate signature or expiration #1878391 Valid Cryptography Medium 2024-07-14 $750 29 External storage - global credentials returned to the client side in plaintext #2554079 Valid Information Disclosure Medium 2024-11-21 – 28