User can delete data in shared folders he's not autorized to access Analysed #642515 Valid Access Control Medium 2020-04-10 – 173 Access to all files of remote user through shared file Analysed #258084 Valid Information Disclosure Medium 2020-03-01 – 154 PIN bypass in PassCodeActivity via back button Analysed #3625210 Valid Authentication Medium 2026-06-07 $150 101 Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope Analysed #3617729 Valid Information Disclosure Medium 2026-09-04 $250 101 Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId) Analysed #3572848 Valid Access Control Medium 2026-05-21 $150 100 Re-Sharing allows increase of privileges Analysed #889243 Valid Access Control Medium 2020-09-28 – 92 No rate limiting for confirmation email lead to huge Mass mailings Analysed #997070 Valid Input Validation and Logic Medium 2020-11-04 – 82 Stored XSS Vulnerability via SVG File Analysed #3357808 Valid Cross-site Scripting Medium 2025-12-05 $150 79 User deletion is not handled properly everywhere Analysed #1200700 Valid No weakness recorded Medium 2021-07-15 $1,000 78 CSRF protection on OIDC login is broken Analysed #1878381 Valid Cross-Site Request Forgery Medium 2023-04-04 $500 77 TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot Analysed #3799010 Valid Insecure Direct Object Reference Medium 2026-08-14 – 73 Nextcloud Desktop Client RCE via malicious URI schemes Analysed #1078002 Valid Injection and Smuggling Medium 2021-04-15 $1,000 73 Directory Listing of publicly available assets Analysed #2311179 Valid Information Disclosure Medium 2025-09-29 – 70 File-drop content is visible through the gallery app Analysed #719426 Valid No weakness recorded Medium 2020-01-31 – 68 ID4me feature of OpenID connect app available even when disabled Analysed #2376929 Valid Access Control Medium 2024-05-30 – 66 Valid share tokens allow to access tempory upload files of share owner Analysed #3483708 Valid Access Control Medium 2026-06-07 – 65 Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes Analysed #3610332 Valid Input Validation and Logic Medium 2026-09-17 $150 63 Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library Analysed #3249624 Valid File and Path Handling Medium 2025-10-16 – 63 Arbitrary Board Preference Injection via Deck Config API Analysed #3599383 Valid Access Control Medium 2026-09-17 $200 62 Arbitrary code execution in desktop client via OpenSSL config Analysed #622170 Valid Command and Code Injection Medium 2020-08-05 $100 59 SVG filter primitives bypass remote image blocking, enabling email tracking without consent. Analysed #3486747 Valid Information Disclosure Medium 2026-04-20 – 53 Notes app can be tricked into using a received share created before the user logged in Analysed #2254151 Valid Input Validation and Logic Medium 2024-06-19 – 49 Download permissions can be changed by resharer Analysed #1724016 Valid Access Control Medium 2023-02-24 $500 49 SSRF via User-Controlled Push proxyServer in Notifications Push Registration Analysed #3623149 Valid Server-Side Request Forgery Medium 2026-09-30 – 48 Mail stored HTML injection in subject text Analysed #3357036 Valid No weakness recorded Medium 2026-02-12 – 48 Exposing debug.log file leads to server full path disclosure Analysed #2778441 Valid Input Validation and Logic Medium 2025-09-29 – 47 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes Analysed #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 Inviting excessive long email addresses to a calendar event makes the server unresponsive Analysed #2058337 Valid Denial of Service Medium 2023-10-16 – 46 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays. Analysed #3590586 Valid Injection and Smuggling Medium 2026-04-20 – 44 User can copy locked folders and gain access to the contents Analysed #2447316 Valid Access Control Medium 2024-11-16 $500 44 Path traversal allows tricking the Talk Android app into writing files into it's root directory Analysed #1997029 Valid File and Path Handling Medium 2023-08-14 – 43 SSL certificate not validated when registering with a provider Analysed #903424 Valid Cryptography Medium 2021-06-02 $300 43 Can download files by zipping the folder Analysed #2247457 Valid Access Control Medium 2024-02-17 – 41 Memory Leak in OCUtil.dll library in Desktop client can lead to DoS Analysed #588562 Valid Denial of Service Medium 2020-08-06 $100 40 Stored XSS in attachment-display exploitable through SameSite Analysed #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 Approval app allows users to request approval for other users file Analysed #3338748 Valid Authentication Medium 2025-12-05 – 39 Unauthenticated testing endpoint of notify_push expose internal IP Analysed #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 Deck app allowed user with "Can share" permission to modify permissions of other non-owners Analysed #3247499 Valid Access Control Medium 2025-12-05 – 38 admin_audit does not log actions on files in a group folder Analysed #2890071 Valid Other weaknesses Medium 2025-12-05 – 38 DNS pin middleware can be tricked into DNS rebinding allowing SSRF Analysed #2115212 Valid Server-Side Request Forgery Medium 2024-01-01 – 38 Read-only users can restore old versions Analysed #1356508 Valid Access Control Medium 2024-06-14 $500 38 Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute) Analysed #3400143 Valid Authentication Medium 2026-04-13 $250 37 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com Analysed #2446531 Valid Cryptography Medium 2024-05-22 – 37 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups Analysed #3674940 Valid Access Control Medium 2026-09-17 – 36 Unquoted body background attribute enables CSS injection that bypasses remote image blocking Analysed #3590583 Valid Injection and Smuggling Medium 2026-04-20 – 35 2FA Session not expires after the password reset Analysed #486693 Valid Authentication Medium 2021-01-18 $50 35 Incomplete sanitization in SVG preview provider Analysed #2484499 Valid Information Disclosure Medium 2024-12-15 $250 34 Brute force protection allows to send more requests than intended Analysed #1918525 Valid Authentication Medium 2023-07-13 $500 34 Ability to read any emails through IDOR on Nextcloud Mail Analysed #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 SSRF via filter bypass due to lax checking on IPs Analysed #1702864 Valid Server-Side Request Forgery Medium 2023-02-10 $250 33