Browse / Nextcloud

Nextcloud

See its reports on the map

Attack surface: 1,639 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Nextcloud

• Access Control105
• Information Disclosure104
• Authentication82
• Misconfiguration65
• Cross-site Scripting56
• Other weaknesses26

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Code injection possible with malformed Nextcloud Talk chat commandsCode Injection · high
   317 votes
2. User can delete data in shared folders he's not autorized to accessImproper Access Control - Generic · medium
   173 votes
3. Access to all files of remote user through shared fileInformation Disclosure · medium
   154 votes
4. Attacker can obtain write access to any federated share/public linkImproper Authentication - Generic · high
   $4,000142 votes
5. Missing ownership check on remote wipe endpointInsecure Direct Object Reference (IDOR) · high
   $500141 votes
6. Remote Code Execution via Extract App PluginOS Command Injection · high
   124 votes
7. Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/Information Disclosure · low
   113 votes
8. PIN bypass in PassCodeActivity via back buttonImproper Authentication - Generic · medium
   $150101 votes
9. Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scopePrivacy Violation · medium
   $250101 votes
10. Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)Improper Access Control - Generic · medium
    $150100 votes
11. Re-Sharing allows increase of privilegesImproper Privilege Management · medium
    92 votes
12. View-only guests could see deleted Collectives pages in the trashbinImproper Access Control - Generic · low
    87 votes
13. Private circle can be added to another circle via API despite visibility restrictionInsecure Direct Object Reference (IDOR) · low
    $15087 votes
14. WebAuthn app was updated based on public keyInsecure Direct Object Reference (IDOR) · low
    84 votes
15. RCE on Wordpress websiteDeserialization of Untrusted Data · critical
    83 votes
16. No rate limiting for confirmation email lead to huge Mass mailingsBusiness Logic Errors · medium
    82 votes
17. SQL Injection in Column Type Parameter Allows Arbitrary SQL ExecutionSQL Injection · high
    80 votes
18. Stored XSS Vulnerability via SVG FileCross-site Scripting (XSS) - Stored · medium
    $15079 votes
19. User deletion is not handled properly everywheremedium
    $1,00078 votes
20. CSRF protection on OIDC login is brokenCross-Site Request Forgery (CSRF) · medium
    $50077 votes
21. Arbitrary SQL command injectionSQL Injection · critical
    77 votes
22. TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk BotInsecure Direct Object Reference (IDOR) · medium
    73 votes
23. Nextcloud Desktop Client RCE via malicious URI schemesResource Injection · medium
    $1,00073 votes
24. Directory Listing of publicly available assetsInformation Exposure Through Directory Listing · medium
    70 votes
25. File-drop content is visible through the gallery appInformation Disclosure · medium
    68 votes
26. ID4me feature of OpenID connect app available even when disabled Improper Access Control - Generic · medium
    66 votes
27. Valid share tokens allow to access tempory upload files of share ownerImproper Access Control - Generic · medium
    65 votes
28. Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-ServiceImproper Null Termination
    65 votes
29. Improper input validation in emoji field leads to sidebar UI denial of serviceBusiness Logic Errors · low
    64 votes
30. Two-factor authentication enforcement bypassImproper Authentication - Generic · high
    $75064 votes
31. Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changesBusiness Logic Errors · medium
    $15063 votes
32. Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet LibraryPath Traversal · medium
    63 votes
33. Arbitrary Board Preference Injection via Deck Config APIImproper Access Control - Generic · medium
    $20062 votes
34. Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Insecure Direct Object Reference (IDOR) · low
    60 votes
35. Arbitrary code execution in desktop client via OpenSSL configCode Injection · medium
    $10059 votes
36. Default Nextcloud Server and Android Client leak sharee searches to NextcloudImproper Access Control - Generic · low
    $75058 votes
37. Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lockInformation Disclosure · low
    58 votes
38. Calendar app allowed booking appointments without the generated tokenInsecure Direct Object Reference (IDOR) · low
    57 votes
39. Easy way to create a new Deck board without permission Improper Access Control - Generic
    $10056 votes
40. Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDCImproper Authentication - Generic · high
    $2,50055 votes
41. SVG filter primitives bypass remote image blocking, enabling email tracking without consent.Privacy Violation · medium
    53 votes
42. Basic auth header on WebDAV requests is not bruteforce protectedImproper Restriction of Authentication Attempts · high
    53 votes
43. Clear text storage of proxy parameters and passwordsCleartext Storage of Sensitive Information · low
    53 votes
44. Authentication bypass in Global Site Selector allows an attacker to log in as any userImproper Authentication - Generic · critical
    50 votes
45. XSS in Desktop Client in the notificationsCross-site Scripting (XSS) - Generic · low
    $75050 votes
46. Notes app can be tricked into using a received share created before the user logged inBusiness Logic Errors · medium
    49 votes
47. Download permissions can be changed by resharerImproper Access Control - Generic · medium
    $50049 votes
48. SSRF via User-Controlled Push proxyServer in Notifications Push RegistrationServer-Side Request Forgery (SSRF) · medium
    48 votes
49. Mail stored HTML injection in subject textCross-site Scripting (XSS) - Generic · medium
    48 votes
50. Stored XSS in collabora via user nameCross-site Scripting (XSS) - Stored · low
    48 votes
51. Exposing debug.log file leads to server full path disclosureBusiness Logic Errors · medium
    47 votes
52. Can download files on Android app without permissionImproper Access Control - Generic · low
    $25047 votes
53. Roundcube Webmail Style Sanitizer can be bypassed using CSS Character EscapesInformation Disclosure · medium
    46 votes
54. Inviting excessive long email addresses to a calendar event makes the server unresponsiveUncontrolled Resource Consumption · medium
    46 votes
55. Password reset endpoint is not brute force protectedImproper Restriction of Authentication Attempts · high
    $50046 votes
56. Events information leaked with shared calendars on recurrence exceptionsInformation Disclosure · low
    $10045 votes
57. Delete external storage of any userImproper Access Control - Generic · high
    45 votes
58. OAuth2 "authorization_code" is valid indefinetlyViolation of Secure Design Principles · low
    $10045 votes
59. position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.Resource Injection · medium
    44 votes
60. User can copy locked folders and gain access to the contentsImproper Access Control - Generic · medium
    $50044 votes
61. Blind SSRF Vulnerability in Appstore Release Upload FormImproper Access Control - Generic · low
    43 votes
62. Path traversal allows tricking the Talk Android app into writing files into it's root directory Path Traversal · medium
    43 votes
63. End-to-end encrypted file-drops can be made inaccessibleImproper Access Control - Generic · high
    $40043 votes
64. SSL certificate not validated when registering with a providerCryptographic Issues - Generic · medium
    $30043 votes
65. Email not verified when changing afterwards on apps.nextcloud.comViolation of Secure Design Principles · low
    42 votes
66. http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacementOpen Redirect
    42 votes
67. xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack.XML External Entities (XXE)
    41 votes
68. Can download files by zipping the folderImproper Access Control - Generic · medium
    41 votes
69. Remote code execution via path traversal in Zip extraction in the Extract appPath Traversal · high
    40 votes
70. Memory Leak in OCUtil.dll library in Desktop client can lead to DoSUncontrolled Resource Consumption · medium
    $10040 votes
71. Stored XSS in attachment-display exploitable through SameSiteCross-site Scripting (XSS) - Stored · medium
    39 votes
72. Approval app allows users to request approval for other users file Improper Authentication - Generic · medium
    39 votes
73. No password length limit when creating a user as an administratorUncontrolled Resource Consumption · low
    39 votes
74. Scoped apptokens can be changed by that very apptokenImproper Access Control - Generic · high
    $1,00039 votes
75. Unauthenticated testing endpoint of notify_push expose internal IPInformation Disclosure · medium
    $15038 votes
76. Deck app allowed user with "Can share" permission to modify permissions of other non-ownersImproper Access Control - Generic · medium
    38 votes
77. admin_audit does not log actions on files in a group folderInsufficient Logging · medium
    38 votes
78. DNS pin middleware can be tricked into DNS rebinding allowing SSRFServer-Side Request Forgery (SSRF) · medium
    38 votes
79. Read-only users can restore old versionsImproper Access Control - Generic · medium
    $50038 votes
80. Expired reshare links allow access to all files in shareImproper Access Control - Generic · critical
    38 votes
81. Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute)Insufficiently Protected Credentials · medium
    $25037 votes
82. tabnabbing in roundcube webmailViolation of Secure Design Principles
    37 votes
83. Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.comUse of a Broken or Risky Cryptographic Algorithm · medium
    37 votes
84. Code injection in Nextcloud Desktop Client for macOSCode Injection
    $25037 votes
85. Blind SSRF in Mail AppServer-Side Request Forgery (SSRF) · low
    37 votes
86. [Reflected XSS] In Request URLCross-site Scripting (XSS) - Reflected · low
    37 votes
87. Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groupsImproper Access Control - Generic · medium
    36 votes
88. Arbitrary read of all SVG files on a Nextcloud serverPath Traversal · high
    $1,25036 votes
89. SQL Injection found in NextCloud Android App Content ProviderSQL Injection · low
    $15036 votes
90. Unquoted body background attribute enables CSS injection that bypasses remote image blockingResource Injection · medium
    35 votes
91. Email Enumeration via Password-Protected Share Identity VerificationInformation Disclosure · low
    $10035 votes
92. 2FA Session not expires after the password resetSession Fixation · medium
    $5035 votes
93. No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deletedViolation of Secure Design Principles
    35 votes
94. Mail auto configurator can be tricked into sending account information to wrong servers Information Disclosure · high
    $10034 votes
95. Incomplete sanitization in SVG preview providerInformation Disclosure · medium
    $25034 votes
96. Brute force protection allows to send more requests than intendedImproper Restriction of Authentication Attempts · medium
    $50034 votes
97. Ability to read any emails through IDOR on Nextcloud MailInsecure Direct Object Reference (IDOR) · medium
    34 votes
98. App PIN code can be bypassed in Files iOSImproper Authentication - Generic · low
    $10033 votes
99. SSRF via filter bypass due to lax checking on IPsServer-Side Request Forgery (SSRF) · medium
    $25033 votes
100. Can reshare read&share only folder with more permissionsImproper Access Control - Generic · high
     $75032 votes