Nextcloud · Report #3534050
Activity app does not verify federated file activity received from remote servers
Validstatus
lowseverity
$150bounty
16upvotes
5 Sept 2026disclosed
Summary
The activity app did not verify the activity content received from remote servers before storing them in the user's stream
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.