Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| I am because bug#226097 | Spam | No weakness recorded | – | 2017-05-04 | – | 32 |
| IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email#230328 | Valid | Insecure Direct Object Reference | – | 2017-09-16 | – | 29 |
| Reflected XSS in error pages (NC-SA-2017-008)#216812 | Valid | Cross-site Scripting | – | 2017-05-15 | $450 | 28 |
| https://xmpp.nextcloud.com///;@www.google.com allows open redirect#211213 | Valid | Open Redirect | – | 2017-08-13 | – | 20 |
| DOM XSS vulnerability in search dialogue (NC-SA-2017-007)#213227 | Valid | Cross-site Scripting | – | 2017-06-07 | $250 | 16 |
| Android - Possible to intercept broadcasts about uploaded files#167481 | Valid | Information Disclosure | – | 2017-03-23 | – | 16 |
| Email Spoofing Vulnerability from nextcloud.#229599 | Spam | No weakness recorded | – | 2017-05-18 | – | 15 |
| Content Spoofing/Text Injection in https://demo.nextcloud.com#222058 | Valid | Misconfiguration and Insecure Design | – | 2017-04-28 | – | 13 |
| Design Issues on ( ███ ) Lead to show ( IPS of Users )#218733 | Valid | No weakness recorded | – | 2017-04-05 | – | 13 |
| https://portal.nextcloud.com/.htaccess file is readable#220946 | Valid | Information Disclosure | – | 2017-04-14 | – | 12 |
| Wordpress 4.7.1#201489 | Valid | No weakness recorded | – | 2017-01-27 | – | 12 |
| Disclosure of administrators via JSON on nextcloud.com Wordpress#198012 | Valid | Information Disclosure | – | 2017-01-13 | – | 12 |
| WordPress <= 4.6.1 Stored XSS Via Theme File#197878 | Valid | Cross-site Scripting | – | 2017-01-13 | – | 12 |
| Wordpress Vulnerable to Potential Unauthorized Password Reset#226037 | Valid | No weakness recorded | – | 2017-08-15 | – | 11 |
| Invalid request may lead content spoofing for phishing#213056 | Valid | Misconfiguration and Insecure Design | – | 2017-04-12 | – | 11 |
| GIT Detected#221298 | Valid | Information Disclosure | – | 2017-04-20 | – | 10 |
| Group admin can remove user from all his groups via API#199286 | Valid | No weakness recorded | – | 2017-02-23 | – | 10 |
| bug reporting template encourages users to paste config file with passwords#196878 | Valid | Information Disclosure | – | 2017-04-19 | – | 10 |
| Reflected XSS in U2F plugin by shipping the example endpoints#192786 | Valid | Cross-site Scripting | – | 2017-03-22 | – | 10 |
| Files Drop: WebDAV endpoint is leaking existence of resources#187460 | Valid | Information Disclosure | – | 2017-01-01 | – | 9 |
| Bypass permissions#169680 | Valid | Access Control | – | 2017-02-09 | – | 9 |
| Privilege escalation - Normal user can somehow make admin to delete shared folders#166581 | Valid | Access Control | – | 2017-05-20 | – | 9 |
| Update php-saml library to 2.10.5#213789 | Valid | Cryptography | – | 2017-04-27 | – | 8 |
| Missing Rate Limit for Current Password field in nextcloud.com#199714 | Valid | Authentication | – | 2017-05-20 | – | 8 |
| User Information Disclosure via REST API#197877 | Valid | Information Disclosure | – | 2017-02-11 | – | 8 |
| WordPress < 4.8.2 vulnerable to multiple attacks#269705 | Valid | Misconfiguration and Insecure Design | – | 2017-09-27 | – | 7 |
| Calendar and addressbook names disclosed (NC-SA-2017-012)#203594 | Valid | Information Disclosure | – | 2017-05-08 | $183 | 7 |
| Bad content-type in response header when getting document can lead to html injection#173721 | Valid | Cross-site Scripting | – | 2017-01-12 | – | 7 |
| XSS on IOS app via HTML rendering#157434 | Valid | Cross-site Scripting | – | 2017-04-20 | – | 7 |
| Content spoofing due to the improper behavior of the 403 page#214340 | Valid | No weakness recorded | – | 2017-05-18 | – | 6 |
| Content Spoofing/Text Injection in nextcloud.com#213360 | Valid | Misconfiguration and Insecure Design | – | 2017-04-19 | – | 6 |
| Avatar image upload and bypass real image verification#145604 | Informative | Misconfiguration and Insecure Design | – | 2017-01-15 | – | 6 |
| Missing Rate Limiting protection leading to mass triggering of e-mails#224927 | Valid | Misconfiguration and Insecure Design | – | 2017-06-05 | – | 5 |
| Content spoofing due to the improper behavior of the 403 page#212770 | Valid | Misconfiguration and Insecure Design | – | 2017-05-18 | – | 5 |
| Version 4.7.2 of wordpress is vulnerable#211206 | Valid | No weakness recorded | – | 2017-03-07 | – | 5 |
| Missing SPF Flags on nextcloud.com#205250 | Duplicate | Misconfiguration and Insecure Design | – | 2017-02-10 | – | 5 |
| Drone Nextcloud#198773 | Informative | No weakness recorded | – | 2017-02-12 | – | 5 |
| HTTP-Basic Authentication on logs.nextcloud.com#198673 | Informative | Misconfiguration and Insecure Design | – | 2017-01-17 | – | 5 |
| Limitation of app specific password scope can be bypassed (NC-SA-2017-009)#191979 | Valid | Access Control | – | 2017-05-08 | $300 | 5 |
| URI scheme bypass in mail app lead to HTML content spoof and opener control#175085 | Valid | Misconfiguration and Insecure Design | – | 2017-01-12 | – | 5 |
| Dav sharing permissions issue#174896 | Valid | Access Control | – | 2017-05-20 | – | 5 |
| Nextcloud Server Remote Command Execution#226896 | N/A | No weakness recorded | – | 2017-05-10 | – | 4 |
| Clickjacking In https://demo.nextcloud.com#222762 | N/A | Misconfiguration and Insecure Design | – | 2017-05-20 | – | 4 |
| The email API to reset password is unlimited and can be used as a email bomb#222080 | Duplicate | Access Control | – | 2017-04-20 | – | 4 |
| SSRF at apps.nextcloud.com/developer/apps/releases/new#213358 | Informative | Server-Side Request Forgery | – | 2017-04-20 | – | 4 |
| Email Spoofing#200762 | Informative | Misconfiguration and Insecure Design | – | 2017-01-25 | – | 4 |
| Review remote code execution in SwiftMailer#194564 | Valid | Command and Code Injection | – | 2017-02-18 | – | 4 |
| Content Spoofing in "files" app#179073 | Valid | Misconfiguration and Insecure Design | – | 2017-03-06 | $50 | 4 |
| Filename enumeration && DoS#174524 | Valid | Denial of Service | – | 2017-02-09 | – | 4 |
| Bypassing quota limit#173622 | Valid | Access Control | – | 2017-03-10 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.