Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-ServiceAnalysed#3399016	Valid	Memory Corruption	None	2026-05-01	–	65
SMTP header injection via C-escape `\r` in the recipient display nameAnalysed#3913007	Valid	Memory Corruption	None	2026-10-18	–	23
Self XSS when sending HTML as a comment in the Deck appAnalysed#2058556	Valid	Cross-site Scripting	None	2024-01-18	–	20
Persistent SMTP header injection via identity `organization` / `name`Analysed#3913012	Valid	Memory Corruption	None	2026-09-18	–	19
Group admin can remove user from all his groups via API#199286	Valid	No weakness recorded	None	2017-02-23	–	10
Allows any user to share their "Root" level folder by sharing "."#889795	Valid	Access Control	None	2020-06-03	–	9
Some HTML Tags are Getting Executed in com.nextcloud.client#631227	Valid	Command and Code Injection	None	2019-07-26	–	9
Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory#3159877	Valid	Information Disclosure	None	2026-01-04	–	8
Disabled user can reset their password#261297	Valid	Misconfiguration and Insecure Design	None	2020-03-01	–	7
HTML injection with AutoComplete suggestions#383117	Valid	Cross-site Scripting	None	2018-08-10	–	5
LDAP login possible even though account doesn't match user filter#205908	Valid	Authentication	None	2019-07-27	–	5
Ratelimits do not apply to OCS DataResponse#1214158	Valid	Authentication	None	2021-08-11	–	4
Review remote code execution in SwiftMailer#194564	Valid	Command and Code Injection	None	2017-02-18	–	4
Content spoofing due to the improper behavior of the 403 page in Private Server#177335	Valid	Misconfiguration and Insecure Design	None	2016-10-31	–	4
Bypassing quota limit#173622	Valid	Access Control	None	2017-03-10	–	4
Contacts only sanitizes PHOTO svg if mime type is all lower case#1789602	Valid	Cross-site Scripting	None	2023-06-24	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.