Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusValid
WeaknessAny class
- Any class
- Cross-site Scripting51
- Cross-Site Request Forgery4
- Open Redirect6
- Server-Side Request Forgery16
- SQL Injection5
- Command and Code Injection16
- Injection and Smuggling12
- Deserialization and Object Injection2
- File and Path Handling9
- Memory Corruption7
- Denial of Service23
- Input Validation and Logic19
- Misconfiguration and Insecure Design41
- Cryptography23
- Information Disclosure65
- Authentication58
- Access Control98
- Insecure Direct Object Reference20
- Other weaknesses1
- No weakness recorded41
Access (title)Any
Access (analysis)Any
TechniqueAny
517 of 15,219 reports · $41,553 in bounties · 227 analysed so far
- #851807ValidAnalysedCode injection possible with malformed Nextcloud Talk chat commandsNextcloud · Command and Code Injection · 2020 · needs: a user account · OS command injection–317votes
- #642515ValidUser can delete data in shared folders he's not autorized to accessNextcloud · Access Control · 2020–173votes
- #258084ValidAccess to all files of remote user through shared fileNextcloud · Information Disclosure · 2020–154votes
- #1170024ValidAttacker can obtain write access to any federated share/public linkNextcloud · Authentication · 2021$4,000142votes
- #819807ValidMissing ownership check on remote wipe endpointNextcloud · Insecure Direct Object Reference · 2020$500141votes
- #546753ValidRemote Code Execution via Extract App PluginNextcloud · Command and Code Injection · 2019–124votes
- #2946927ValidSensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/Nextcloud · No weakness recorded · 2025 · Low–113votes
- #3625210ValidPIN bypass in PassCodeActivity via back buttonNextcloud · Authentication · 2026 · Medium$150101votes
- #3617729ValidMail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scopeNextcloud · Information Disclosure · 2026 · Medium$250101votes
- #3572848ValidGroup restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)Nextcloud · Access Control · 2026 · Medium$150100votes
- #889243ValidRe-Sharing allows increase of privilegesNextcloud · Access Control · 2020–92votes
- #3521434ValidView-only guests could see deleted Collectives pages in the trashbinNextcloud · Access Control · 2026 · Low · a user account (title)–87votes
- #3511998ValidPrivate circle can be added to another circle via API despite visibility restrictionNextcloud · Insecure Direct Object Reference · 2026 · Low$15087votes
- #3360354ValidWebAuthn app was updated based on public keyNextcloud · Insecure Direct Object Reference · 2026 · Low–84votes
- #2248328ValidRCE on Wordpress websiteNextcloud · Deserialization and Object Injection · 2023–83votes
- #997070ValidNo rate limiting for confirmation email lead to huge Mass mailingsNextcloud · Input Validation and Logic · 2020–82votes
- #3462991ValidSQL Injection in Column Type Parameter Allows Arbitrary SQL ExecutionNextcloud · SQL Injection · 2026 · High–80votes
- #3357808ValidStored XSS Vulnerability via SVG FileNextcloud · Cross-site Scripting · 2025 · Medium$15079votes
- #1200700ValidUser deletion is not handled properly everywhereNextcloud · No weakness recorded · 2021$1,00078votes
- #1878381ValidCSRF protection on OIDC login is brokenNextcloud · Cross-Site Request Forgery · 2023$50077votes
- #508487ValidArbitrary SQL command injectionNextcloud · SQL Injection · 2019–77votes
- #3799010ValidTaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk BotNextcloud · Insecure Direct Object Reference · 2026 · Medium–73votes
- #1078002ValidNextcloud Desktop Client RCE via malicious URI schemesNextcloud · Injection and Smuggling · 2021$1,00073votes
- #2311179ValidDirectory Listing of publicly available assetsNextcloud · Information Disclosure · 2025 · Medium–70votes
- #719426ValidFile-drop content is visible through the gallery appNextcloud · No weakness recorded · 2020–68votes
- #2376929ValidID4me feature of OpenID connect app available even when disabledNextcloud · Access Control · 2024 · Medium–66votes
- #3483708ValidValid share tokens allow to access tempory upload files of share ownerNextcloud · Access Control · 2026 · Medium–65votes
- #3399016ValidImproper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-ServiceNextcloud · Memory Corruption · 2026 · None–65votes
- #3599470ValidImproper input validation in emoji field leads to sidebar UI denial of serviceNextcloud · Input Validation and Logic · 2026 · Low–64votes
- #1050244ValidTwo-factor authentication enforcement bypassNextcloud · No weakness recorded · 2021$75064votes
- #3610332ValidApproval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changesNextcloud · Input Validation and Logic · 2026 · Medium$15063votes
- #3249624ValidPath Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet LibraryNextcloud · File and Path Handling · 2025 · Medium–63votes
- #3599383ValidArbitrary Board Preference Injection via Deck Config APINextcloud · Access Control · 2026 · Medium$20062votes
- #3304830ValidFiles drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share ownerNextcloud · Insecure Direct Object Reference · 2026 · Low–60votes
- #622170ValidArbitrary code execution in desktop client via OpenSSL configNextcloud · Command and Code Injection · 2020$10059votes
- #1167916ValidDefault Nextcloud Server and Android Client leak sharee searches to NextcloudNextcloud · Access Control · 2021$75058votes
- #331489ValidExtremly simple way to bypass Nextcloud-Client PIN/Fingerprint lockNextcloud · Information Disclosure · 2019–58votes
- #3275810ValidCalendar app allowed booking appointments without the generated tokenNextcloud · Insecure Direct Object Reference · 2025 · Low–57votes
- #2388183ValidEasy way to create a new Deck board without permissionNextcloud · Access Control · 2026$10056votes
- #3489490ValidAuthentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDCNextcloud · Authentication · 2026 · High$2,50055votes
- #3486747ValidSVG filter primitives bypass remote image blocking, enabling email tracking without consent.Nextcloud · Information Disclosure · 2026 · Medium–53votes
- #1879549ValidBasic auth header on WebDAV requests is not bruteforce protectedNextcloud · Authentication · 2023–53votes
- #685990ValidClear text storage of proxy parameters and passwordsNextcloud · Cryptography · 2020–53votes
- #2248689ValidAuthentication bypass in Global Site Selector allows an attacker to log in as any userNextcloud · No weakness recorded · 2024–50votes
- #1668028ValidXSS in Desktop Client in the notificationsNextcloud · Cross-site Scripting · 2022$75050votes
- #2254151ValidNotes app can be tricked into using a received share created before the user logged inNextcloud · Input Validation and Logic · 2024 · Medium–49votes
- #1724016ValidDownload permissions can be changed by resharerNextcloud · Access Control · 2023$50049votes
- #3623149ValidSSRF via User-Controlled Push proxyServer in Notifications Push RegistrationNextcloud · Server-Side Request Forgery · 2026 · Medium–48votes
- #3357036ValidMail stored HTML injection in subject textNextcloud · No weakness recorded · 2026 · Medium–48votes
- #968232ValidStored XSS in collabora via user nameNextcloud · Cross-site Scripting · 2020–48votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.