Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Unauthenticated SSRF via Public Reference API -Sharing Token Bypass#3479692 | Informative | No weakness recorded | – | 2026-03-31 | – | 41 |
| BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data#3382343 | Informative | Insecure Direct Object Reference | Medium | 2026-04-14 | – | 40 |
| Invisible Salamanders Attack against end_to_end_encryption in Nextcloud#2497947 | Informative | Cryptography | Medium | 2024-12-03 | – | 38 |
| [nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed#2902856 | Informative | Server-Side Request Forgery | Medium | 2025-12-23 | – | 25 |
| Server side request forgery (SSRF) on nextcloud implementation.#145524 | Informative | No weakness recorded | – | 2016-06-17 | – | 19 |
| Predictable Random Number Generator#504731 | Informative | Cryptography | Medium | 2019-06-26 | – | 12 |
| No Rate Limiting on stats.nextcloud.com login#146424 | Informative | Misconfiguration and Insecure Design | – | 2016-06-22 | – | 12 |
| The session token in the URL#341372 | Informative | Information Disclosure | Medium | 2018-06-19 | – | 11 |
| Bruteforcing help.nextcloud.com#145727 | Informative | Authentication | – | 2016-06-19 | – | 10 |
| help.nextcloud Email Address/Username enumeration#145734 | Informative | Information Disclosure | – | 2016-06-19 | – | 9 |
| Password policy changes not enforced for existing passwords#1169335 | Informative | Authentication | Low | 2021-04-26 | – | 7 |
| Unexpected federated shares added via public link#1167767 | Informative | Access Control | Medium | 2021-04-26 | – | 7 |
| Click Jacking Nextcloud#347782 | Informative | Misconfiguration and Insecure Design | Low | 2019-07-01 | – | 7 |
| Email Notification should be get while changing password on apps.nextcloud.com#308156 | Informative | No weakness recorded | – | 2018-02-28 | – | 7 |
| Targeted phishing attacks in Login flow v2#1169033 | Informative | Input Validation and Logic | Medium | 2023-03-03 | – | 6 |
| bypassing dashboard without account + Information disclosure trough websockets#1102780 | Informative | Access Control | High | 2021-04-20 | – | 6 |
| Leaked of Profile Image from URL changing#1022211 | Informative | No weakness recorded | – | 2020-11-17 | – | 6 |
| Recently change email but still login with old email#986459 | Informative | Authentication | High | 2020-09-29 | – | 6 |
| Passcode Protection in Android Devices Can be Bypassed.#631206 | Informative | Misconfiguration and Insecure Design | Medium | 2019-08-27 | – | 6 |
| Wordpress Version Disclosure Bug On Nextcloud#188132 | Informative | Information Disclosure | Low | 2016-12-04 | – | 6 |
| Avatar image upload and bypass real image verification#145604 | Informative | Misconfiguration and Insecure Design | – | 2017-01-15 | – | 6 |
| Talk discloses turn server to anybody#1195593 | Informative | No weakness recorded | Low | 2021-05-26 | – | 5 |
| No set limit to try to login in "https://auth.nextcloud.com/auth/realms/master/protocol/openid-connect/auth" page.#855304 | Informative | Authentication | – | 2021-04-20 | – | 5 |
| Vulnerable W3 Total Cache plugin version in use on nextcloud.com#579116 | Informative | Cross-Site Request Forgery | Medium | 2019-06-21 | – | 5 |
| Banner Grabbing - Apache Server Version Disclousure#269449 | Informative | Information Disclosure | – | 2018-05-17 | – | 5 |
| RTLO character allowed in shared files#229170 | Informative | Misconfiguration and Insecure Design | Medium | 2020-08-17 | – | 5 |
| Drone Nextcloud#198773 | Informative | No weakness recorded | – | 2017-02-12 | – | 5 |
| HTTP-Basic Authentication on logs.nextcloud.com#198673 | Informative | Misconfiguration and Insecure Design | – | 2017-01-17 | – | 5 |
| Email ID Disclosure.#146106 | Informative | Information Disclosure | – | 2016-06-20 | – | 5 |
| Business/Functional logic bypass: Remove admins from admin group.#145745 | Informative | Access Control | – | 2016-06-19 | – | 5 |
| Vulnerable Javascript library#145517 | Informative | Information Disclosure | – | 2016-06-17 | – | 5 |
| Possible RCE#145343 | Informative | Command and Code Injection | – | 2018-03-08 | – | 5 |
| No admin audit entry for enabling/disabling 2FA#1200989 | Informative | No weakness recorded | Low | 2021-06-16 | – | 4 |
| Full path disclosure vulnerability via Upload .htaccess file#919429 | Informative | Information Disclosure | – | 2020-07-09 | – | 4 |
| SignUp using Fake Email#664200 | Informative | Input Validation and Logic | – | 2019-08-02 | – | 4 |
| Banner Grabbing - Apache Server Version Disclosure#348801 | Informative | Information Disclosure | – | 2018-05-17 | – | 4 |
| Information Exposure Through Directory Listing#260221 | Informative | Information Disclosure | None | 2018-05-17 | – | 4 |
| SSRF at apps.nextcloud.com/developer/apps/releases/new#213358 | Informative | Server-Side Request Forgery | – | 2017-04-20 | – | 4 |
| Email Spoofing#200762 | Informative | Misconfiguration and Insecure Design | – | 2017-01-25 | – | 4 |
| REG: Content provider information leakage#146179 | Informative | Command and Code Injection | – | 2016-06-24 | – | 4 |
| WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available#146093 | Informative | Information Disclosure | – | 2016-06-22 | – | 4 |
| Information Exposure Through Directory Listing vulnerability#1476709 | Informative | Information Disclosure | Medium | 2022-02-11 | – | 3 |
| No admin audit log for auth tokens#1200992 | Informative | No weakness recorded | Low | 2021-06-16 | – | 3 |
| Default Nextcloud allows http federated shares#1183302 | Informative | No weakness recorded | Medium | 2021-05-11 | – | 3 |
| Nextcloud update checks leaks information#1173411 | Informative | Information Disclosure | None | 2021-05-01 | – | 3 |
| Federated shares are not password protected#1167817 | Informative | Authentication | Medium | 2021-06-16 | – | 3 |
| Veracode and security audit record are publicly available#669365 | Informative | Information Disclosure | Low | 2019-09-10 | – | 3 |
| XSS On Nextcloud Integrated with zimbra drive#498852 | Informative | Cross-site Scripting | Medium | 2019-11-11 | – | 3 |
| Retrieval and alteration of exposed media on Android Oreo#462441 | Informative | Information Disclosure | Medium | 2019-06-26 | – | 3 |
| Content (Text) Injection at https://nextcloud.com#222805 | Informative | Misconfiguration and Insecure Design | Low | 2017-05-15 | – | 3 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.