PIN bypass in PassCodeActivity via back button Analysed #3625210 Valid Authentication Medium 2026-06-07 $150 101 Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope Analysed #3617729 Valid Information Disclosure Medium 2026-09-04 $250 101 Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId) Analysed #3572848 Valid Access Control Medium 2026-05-21 $150 100 View-only guests could see deleted Collectives pages in the trashbin Analysed #3521434 Valid Access Control Low 2026-05-08 – 87 Private circle can be added to another circle via API despite visibility restriction Analysed #3511998 Valid Insecure Direct Object Reference Low 2026-05-08 $150 87 WebAuthn app was updated based on public key Analysed #3360354 Valid Insecure Direct Object Reference Low 2026-02-06 – 84 SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution Analysed #3462991 Valid SQL Injection High 2026-05-15 – 80 TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot Analysed #3799010 Valid Insecure Direct Object Reference Medium 2026-08-14 – 73 Valid share tokens allow to access tempory upload files of share owner Analysed #3483708 Valid Access Control Medium 2026-06-07 – 65 Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-Service Analysed #3399016 Valid Memory Corruption None 2026-05-01 – 65 Improper input validation in emoji field leads to sidebar UI denial of service Analysed #3599470 Valid Input Validation and Logic Low 2026-09-20 – 64 Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes Analysed #3610332 Valid Input Validation and Logic Medium 2026-09-17 $150 63 Arbitrary Board Preference Injection via Deck Config API Analysed #3599383 Valid Access Control Medium 2026-09-17 $200 62 Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Analysed #3304830 Valid Insecure Direct Object Reference Low 2026-05-08 – 60 Easy way to create a new Deck board without permission Analysed #2388183 Valid Access Control – 2026-01-16 $100 56 Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC Analysed #3489490 Valid Authentication High 2026-06-07 $2,500 55 SVG filter primitives bypass remote image blocking, enabling email tracking without consent. Analysed #3486747 Valid Information Disclosure Medium 2026-04-20 – 53 SSRF via User-Controlled Push proxyServer in Notifications Push Registration Analysed #3623149 Valid Server-Side Request Forgery Medium 2026-09-30 – 48 Mail stored HTML injection in subject text Analysed #3357036 Valid No weakness recorded Medium 2026-02-12 – 48 Can download files on Android app without permission Analysed #2380133 Valid Access Control Low 2026-01-16 $250 47 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes Analysed #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays. Analysed #3590586 Valid Injection and Smuggling Medium 2026-04-20 – 44 Unauthenticated SSRF via Public Reference API -Sharing Token Bypass #3479692 Informative No weakness recorded – 2026-03-31 – 41 BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data #3382343 Informative Insecure Direct Object Reference Medium 2026-04-14 – 40 Stored XSS in attachment-display exploitable through SameSite Analysed #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 Unauthenticated testing endpoint of notify_push expose internal IP Analysed #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos #3518758 N/A Insecure Direct Object Reference – 2026-04-07 – 37 Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute) Analysed #3400143 Valid Authentication Medium 2026-04-13 $250 37 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups Analysed #3674940 Valid Access Control Medium 2026-09-17 – 36 Unquoted body background attribute enables CSS injection that bypasses remote image blocking Analysed #3590583 Valid Injection and Smuggling Medium 2026-04-20 – 35 Email Enumeration via Password-Protected Share Identity Verification Analysed #3507273 Valid Information Disclosure Low 2026-09-05 $100 35 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet Analysed #3770482 Valid Access Control Medium 2026-09-18 – 31 SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent Analysed #3590576 Valid File and Path Handling Medium 2026-04-20 – 26 Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables Analysed #3508852 Valid Input Validation and Logic Low 2026-10-20 – 25 Predictable proposal participant tokens enable unauthorized access and vote submission Analysed #3385434 Valid Cryptography Low 2026-01-04 $100 25 SMTP header injection via C-escape `\r` in the recipient display name Analysed #3913007 Valid Memory Corruption None 2026-10-18 – 23 Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app Analysed #3521639 Valid Memory Corruption Low 2026-09-05 – 23 Cross-User Lock/Unlock via Absolute DAV Path Analysed #3301553 Valid Authentication Medium 2026-09-17 – 23 Deck app: Invalid tag color is accepted by API and breaks frontend UI Analysed #3485178 Valid Input Validation and Logic Low 2026-10-20 – 21 Missing Duplicate Check allowing Multiple Retention Rules per System Tag #3521646 Valid Input Validation and Logic Low 2026-09-05 – 20 Users can modify tags on files that do not belong to them #3040887 Valid Access Control Medium 2026-01-04 $150 20 Persistent SMTP header injection via identity `organization` / `name` #3913012 Valid Memory Corruption None 2026-09-18 – 19 Team membership information returned on API level based on ID #3484601 Valid Insecure Direct Object Reference Low 2026-09-17 $200 19 Deck app allows to spoof file extensions by using RTLO characters #2326618 Valid No weakness recorded Medium 2026-01-04 $100 19 Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider #3696266 Valid File and Path Handling Medium 2026-08-24 – 18 SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards #3576823 Valid Server-Side Request Forgery Medium 2026-10-27 $250 17 FederationController::remoteWopiToken() returns full Wopi entity without token type validation #3568116 Valid Access Control Low 2026-10-27 – 17 Activity app does not verify federated file activity received from remote servers #3534050 Valid Authentication Low 2026-09-05 $150 16 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders #3506873 Valid Access Control Medium 2026-09-17 – 16 Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections #3303283 Valid Server-Side Request Forgery Medium 2026-09-17 – 15