Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| OAuth2 Access Token and App Password Security Vulnerability#343111 | Valid | Cryptography | Medium | 2018-07-21 | – | 20 |
| bypass of 2FA#248656 | Valid | Authentication | High | 2018-07-29 | $750 | 20 |
| Session fixation in password protected public download.#237184 | Valid | Authentication | Low | 2018-10-25 | – | 20 |
| Authentication Issue#146133 | Valid | Authentication | – | 2018-10-25 | $50 | 19 |
| Registered users can change app password permissions for any user#297751 | Valid | Insecure Direct Object Reference | Low | 2018-02-08 | $100 | 18 |
| Access control issue -- [Allow file system access not validated when using session auth]#388515 | Valid | Access Control | Medium | 2018-09-25 | $100 | 17 |
| The session token in the URL#341372 | Informative | Information Disclosure | Medium | 2018-06-19 | – | 11 |
| twofactor_auth bypassable if provider fails to load#317711 | Valid | Authentication | Low | 2018-09-27 | – | 10 |
| [FG-VD-17-063] NextCloud Insufficient Attack Protection Vulnerability Notification#232347 | Valid | Command and Code Injection | Low | 2018-07-29 | $100 | 10 |
| Github wikis are editable by anyone#457032 | Valid | Access Control | Medium | 2018-12-07 | – | 8 |
| File access control rules not enforced on image files#358339 | Valid | Access Control | Low | 2018-06-15 | – | 7 |
| Email Notification should be get while changing password on apps.nextcloud.com#308156 | Informative | No weakness recorded | – | 2018-02-28 | – | 7 |
| HTML injection with AutoComplete suggestions#383117 | Valid | Cross-site Scripting | None | 2018-08-10 | – | 5 |
| Banner Grabbing - Apache Server Version Disclousure#269449 | Informative | Information Disclosure | – | 2018-05-17 | – | 5 |
| Shared file link - password protection bypass under certain conditions#231917 | Valid | Information Disclosure | Medium | 2018-09-25 | $50 | 5 |
| Possible RCE#145343 | Informative | Command and Code Injection | – | 2018-03-08 | – | 5 |
| Disclosed Version of PORTS SSH|HTTP|SSL#358102 | Duplicate | Information Disclosure | Low | 2018-06-14 | – | 4 |
| Banner Grabbing - Apache Server Version Disclosure#348801 | Informative | Information Disclosure | – | 2018-05-17 | – | 4 |
| Information Exposure Through Directory Listing#260221 | Informative | Information Disclosure | None | 2018-05-17 | – | 4 |
| Accessing to download.nextcloud.com from original ip adreess | insecure Download#374053 | Informative | Cryptography | – | 2018-07-12 | – | 2 |
| Ubuntu 12.04 Privilege Escalation#380782 | Informative | Access Control | – | 2018-12-18 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,444 analysed so far), which can be wrong. Data as of 2026-11-15.