Access to all files of remote user through shared file Analysed #258084 Valid Information Disclosure Medium 2020-03-01 – 154 Missing ownership check on remote wipe endpoint Analysed #819807 Valid Insecure Direct Object Reference High 2020-04-19 $500 141 Private circle can be added to another circle via API despite visibility restriction Analysed #3511998 Valid Insecure Direct Object Reference Low 2026-05-08 $150 87 WebAuthn app was updated based on public key Analysed #3360354 Valid Insecure Direct Object Reference Low 2026-02-06 – 84 User deletion is not handled properly everywhere Analysed #1200700 Valid No weakness recorded Medium 2021-07-15 $1,000 78 TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot Analysed #3799010 Valid Insecure Direct Object Reference Medium 2026-08-14 – 73 File-drop content is visible through the gallery app Analysed #719426 Valid No weakness recorded Medium 2020-01-31 – 68 Arbitrary Board Preference Injection via Deck Config API Analysed #3599383 Valid Access Control Medium 2026-09-17 $200 62 Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Analysed #3304830 Valid Insecure Direct Object Reference Low 2026-05-08 – 60 Notes app can be tricked into using a received share created before the user logged in Analysed #2254151 Valid Input Validation and Logic Medium 2024-06-19 – 49 Download permissions can be changed by resharer Analysed #1724016 Valid Access Control Medium 2023-02-24 $500 49 Delete external storage of any user Analysed #2212627 Valid Access Control High 2023-11-21 – 45 Can download files by zipping the folder Analysed #2247457 Valid Access Control Medium 2024-02-17 – 41 Approval app allows users to request approval for other users file Analysed #3338748 Valid Authentication Medium 2025-12-05 – 39 Expired reshare links allow access to all files in share Analysed #452854 Valid Access Control Critical 2019-06-27 – 38 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups Analysed #3674940 Valid Access Control Medium 2026-09-17 – 36 Ability to read any emails through IDOR on Nextcloud Mail Analysed #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 Group admins can remove arbitrary data from "data" directory (including admin data) Analysed #508493 Valid Access Control High 2019-08-12 – 32 Share information of Tables app is not limited to affected users Analysed #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 Admins can change authentication details of user configured external storage Analysed #2107934 Valid Access Control Low 2023-12-21 $100 31 Missing ownership check in Tables app allows moving columns into tables of other users Analysed #3137895 Valid Insecure Direct Object Reference Medium 2025-12-05 – 30 Enabling Birthday Contact to any user Analysed #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 Nextcloud mail does not respect download permissions in shares Analysed #1878255 Valid Access Control Low 2024-12-15 $250 29 IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email Analysed #230328 Valid Insecure Direct Object Reference Medium 2017-09-16 – 29 Participants were able to blindly delete poll drafts of other users by ID Analysed #3247386 Valid Insecure Direct Object Reference Medium 2025-12-05 – 27 Cards in Deck are readable by any user Analysed #1331728 Valid Information Disclosure Medium 2023-03-26 – 25 Nextcloud Tables app - inserting rows to an arbitrary table possible Analysed #2671404 Valid No weakness recorded Medium 2024-11-17 – 24 Cross-User Lock/Unlock via Absolute DAV Path Analysed #3301553 Valid Authentication Medium 2026-09-17 – 23 "Secure View" aka "Hide Download" can be bypassed easily Analysed #788257 Valid Access Control High 2020-04-10 – 22 Possibility to delete files attached to deck cards of other users Analysed #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Users can modify tags on files that do not belong to them Analysed #3040887 Valid Access Control Medium 2026-01-04 $150 20 Access control missing while viewing the attachments in the "All boards" Analysed #916704 Valid Insecure Direct Object Reference Medium 2020-09-29 $150 20 Team membership information returned on API level based on ID Analysed #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Registered users can change app password permissions for any user Analysed #297751 Valid Insecure Direct Object Reference Low 2018-02-08 $100 18 User with read-only access to a share can gain write access to sub-folders in the share Analysed #619484 Valid Access Control Medium 2020-03-01 – 17 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders Analysed #3506873 Valid Access Control Medium 2026-09-17 – 16 Missing server side controls when editing the board’s sharing permissions per user Analysed #827816 Valid Access Control High 2020-09-28 – 16 Take over a mail account due missing validation of account id Analysed #1094063 Valid Access Control Medium 2021-06-01 – 15 Access Control: Inject tasks into other users decks Analysed #867052 Valid Access Control Medium 2021-02-02 – 15 Reference caching can leak data to unauthorized users Analysed #1767503 Valid Information Disclosure Medium 2023-01-13 – 14