ID4me feature of OpenID connect app available even when disabled Analysed #2376929 Valid Access Control Medium 2024-05-30 – 66 Authentication bypass in Global Site Selector allows an attacker to log in as any user Analysed #2248689 Valid No weakness recorded Critical 2024-01-18 – 50 Notes app can be tricked into using a received share created before the user logged in Analysed #2254151 Valid Input Validation and Logic Medium 2024-06-19 – 49 Events information leaked with shared calendars on recurrence exceptions Analysed #2479325 Valid Information Disclosure Low 2024-06-14 $100 45 OAuth2 "authorization_code" is valid indefinetly Analysed #1784162 Valid Misconfiguration and Insecure Design Low 2024-02-17 $100 45 User can copy locked folders and gain access to the contents Analysed #2447316 Valid Access Control Medium 2024-11-16 $500 44 xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack. Analysed #2299069 Valid Injection and Smuggling – 2024-02-08 – 41 Can download files by zipping the folder Analysed #2247457 Valid Access Control Medium 2024-02-17 – 41 Invisible Salamanders Attack against end_to_end_encryption in Nextcloud #2497947 Informative Cryptography Medium 2024-12-03 – 38 DNS pin middleware can be tricked into DNS rebinding allowing SSRF Analysed #2115212 Valid Server-Side Request Forgery Medium 2024-01-01 – 38 Read-only users can restore old versions Analysed #1356508 Valid Access Control Medium 2024-06-14 $500 38 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com Analysed #2446531 Valid Cryptography Medium 2024-05-22 – 37 Code injection in Nextcloud Desktop Client for macOS Analysed #2307625 Valid Command and Code Injection – 2024-06-14 $250 37 Blind SSRF in Mail App Analysed #1869714 Valid Server-Side Request Forgery Low 2024-01-10 – 37 Mail auto configurator can be tricked into sending account information to wrong servers Analysed #2508422 Valid Information Disclosure High 2024-11-15 $100 34 Incomplete sanitization in SVG preview provider Analysed #2484499 Valid Information Disclosure Medium 2024-12-15 $250 34 Can reshare read&share only folder with more permissions Analysed #2289425 Valid Access Control High 2024-07-14 $750 32 Bypass password confirmation via Context-dependent access control (CDCA) Analysed #2120667 Valid Access Control Medium 2024-01-17 $100 32 Share information of Tables app is not limited to affected users Analysed #2705507 Valid Insecure Direct Object Reference Low 2024-11-18 – 31 Bruteforce protection in password verification can be bypassed Analysed #2230915 Valid Authentication Medium 2024-01-17 – 31 Open redirect when logging in with user_oidc Analysed #2720030 Valid Open Redirect – 2024-11-15 – 30 Ability to by-pass second factor Analysed #2419776 Valid Authentication Medium 2024-07-14 $1,000 29 Attachments folder for Text app is accessible on Files Drop/Password protected shares Analysed #2376900 Valid Information Disclosure Low 2024-11-15 – 29 ID4ME does not validate signature or expiration Analysed #1878391 Valid Cryptography Medium 2024-07-14 $750 29 Nextcloud mail does not respect download permissions in shares Analysed #1878255 Valid Access Control Low 2024-12-15 $250 29 External storage - global credentials returned to the client side in plaintext Analysed #2554079 Valid Information Disclosure Medium 2024-11-21 – 28 Non-admin users can reset app allowlist to the default Analysed #2250398 Valid Input Validation and Logic Medium 2024-01-18 – 28 X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted files Analysed #2597504 Valid Cryptography Medium 2024-12-15 – 27 Event create can create attachments that link to other websites Analysed #2457588 Valid Open Redirect Medium 2024-07-14 $250 25 Nextcloud Tables app - inserting rows to an arbitrary table possible Analysed #2671404 Valid No weakness recorded Medium 2024-11-17 – 24 Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4 Analysed #2290680 Valid Access Control Medium 2024-07-14 $500 24 Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist Analysed #2251074 Valid Injection and Smuggling Medium 2024-01-18 – 22 Open redirect in user_saml via RelayState parameter Analysed #2263044 Valid Open Redirect Low 2024-01-18 – 21 Self XSS when sending HTML as a comment in the Deck app Analysed #2058556 Valid Cross-site Scripting None 2024-01-18 – 20 Missing permission check when removing a photo from an album Analysed #1946298 Valid Access Control Low 2024-07-14 – 19 see card comments after remove shared board #2289333 Valid Access Control Medium 2024-06-18 – 18 Error when editing a calendar appointment returns stacktrace and query #2108342 Valid Information Disclosure Medium 2024-01-17 – 16