Attacker can obtain write access to any federated share/public link Analysed #1170024 Valid Authentication High 2021-06-10 $4,000 142 User deletion is not handled properly everywhere Analysed #1200700 Valid No weakness recorded Medium 2021-07-15 $1,000 78 Nextcloud Desktop Client RCE via malicious URI schemes Analysed #1078002 Valid Injection and Smuggling Medium 2021-04-15 $1,000 73 Two-factor authentication enforcement bypass Analysed #1050244 Valid No weakness recorded High 2021-07-31 $750 64 Default Nextcloud Server and Android Client leak sharee searches to Nextcloud Analysed #1167916 Valid Access Control Low 2021-06-15 $750 58 SSL certificate not validated when registering with a provider Analysed #903424 Valid Cryptography Medium 2021-06-02 $300 43 Scoped apptokens can be changed by that very apptoken Analysed #1193321 Valid Access Control High 2021-07-15 $1,000 39 2FA Session not expires after the password reset Analysed #486693 Valid Authentication Medium 2021-01-18 $50 35 Database error shown to the user when using a long guest name in richdocuments Analysed #1067824 Valid Information Disclosure – 2021-02-07 – 29 Leak arbitrary file under nextcloud android client privacy directory Analysed #1142918 Valid No weakness recorded Medium 2021-07-17 – 25 Bypass of privacy filter / tracking pixel blocker Analysed #1215251 Valid Information Disclosure Medium 2021-08-11 $100 24 Session fixation on public talk links Analysed #1181962 Valid Authentication Medium 2021-06-16 $100 23 Ratelimiting can be bypassed using IPv6 subnets Analysed #1154003 Valid Authentication Low 2021-07-01 – 23 Denial of Service by requesting to reset a password Analysed #812754 Valid Denial of Service High 2021-01-25 – 20 Clients do not verify server public key Analysed #1192470 Valid No weakness recorded Low 2021-09-23 $250 18 Ransomware protection is missing extentions take 2 #1200785 Valid No weakness recorded Low 2021-07-16 $100 17 public webdav endpoint not bruteforce protected #1192159 Valid No weakness recorded Low 2021-08-11 $100 17 Reflected XSS when renaming a file with a vulnerable name which results in an error #896522 Valid Cross-site Scripting Medium 2021-03-01 $100 17 File drop public link can also be converted to federated share #1167929 Valid Access Control Low 2021-06-10 $500 15 Take over a mail account due missing validation of account id #1094063 Valid Access Control Medium 2021-06-01 – 15 Access Control: Inject tasks into other users decks #867052 Valid Access Control Medium 2021-02-02 – 15 Virtual Data Room / Hide download on collabora is easy to bypass #1194606 Valid Access Control High 2021-08-07 $150 14 Android app does not clear end to end encryption keys #1189168 Valid No weakness recorded Low 2021-06-16 $100 14 End to end encryption public key is not properly verified on Desktop and Android #1189162 Valid No weakness recorded Medium 2021-09-23 $1,500 13 Stored XSS in markdown file with Nextcloud Talk using Internet Explorer #1023787 Valid Cross-site Scripting Low 2021-02-19 – 13 Trusted servers exchange can be triggered by attacker #1167853 Valid Access Control Medium 2021-06-10 $750 12 Add to your nextcloud endpoint is not properly protected #1192144 Valid No weakness recorded Low 2021-08-11 $100 11 Default settings leak federated cloud id to lookup server of all users #1173436 Valid Information Disclosure Low 2021-06-10 $350 11 RCE on 17 different Docker containers on your network #1332433 Valid Command and Code Injection Critical 2021-10-20 – 10 Download of file with arbitrary extension via injection into attachment header #1215263 Valid Command and Code Injection Medium 2021-08-11 $125 10 Admin audit is not properly logging unsetting of expiration date #1200810 Valid No weakness recorded Low 2021-07-15 – 10 End to end encryption folder locking is not properly protected #1189174 Valid Access Control Low 2021-06-10 $250 10 index.php/apps/files_sharing/shareinfo endpoint is not properly protected #1173684 Valid Denial of Service Medium 2021-08-11 $100 10 Clickjacking URLS #1039805 Valid No weakness recorded – 2021-03-10 – 10 Webauthn tokens are not removed on user deletion #1202590 Valid Access Control Medium 2021-08-07 – 9 Nextcloud deck sharee search leaks searches to lookupserver by default #1167958 Valid Access Control Low 2021-05-26 – 9 Acting under any different user via DB-stored credentials #1061591 Valid Access Control High 2021-03-01 – 8 Serverinfo endpoints are not bruteforce protected nor are tokens properly generated #1210458 Valid No weakness recorded Low 2021-06-16 – 7 Password policy changes not enforced for existing passwords #1169335 Informative Authentication Low 2021-04-26 – 7 Default Nextcloud server config and iOS Nextcloud client leak sharee searches to Nextcloud #1167919 Valid Access Control Low 2021-05-31 – 7 Unexpected federated shares added via public link #1167767 Informative Access Control Medium 2021-04-26 – 7 Github wikis are editable by anyone https://github.com/nextcloud/bookmarks/wiki #906322 Valid Access Control – 2021-01-15 – 7 The password of a mail share is not set if the password is given when the share is created (Nextcloud < 18) #888261 Valid Access Control Low 2021-03-04 – 7 Text app leaks file path of shared files #1246721 Valid Information Disclosure Low 2021-08-11 – 6 ApiService#fetch serves content as text/html and inline Content-Disposition #1241460 Valid Cross-site Scripting – 2021-08-11 – 6 HTML Injection on "polls" app - comments section (possibly XSS) #1108420 Valid Cross-site Scripting Low 2021-03-31 – 6 bypassing dashboard without account + Information disclosure trough websockets #1102780 Informative Access Control High 2021-04-20 – 6 Potential DDoS when posting long data into workflow validation rules #1018146 Valid Denial of Service Medium 2021-01-21 – 6 Formula Injection vulnerability in CSV export feature #928280 Valid Command and Code Injection Medium 2021-03-04 – 6 Malicious apps can crash Nextcloud Android client by sending malformed intents #859136 Valid No weakness recorded – 2021-06-17 – 6