Nextcloud bug bounty programs
nextcloud.com Updated
Nextcloud runs two public programs: a Sorona bug bounty paying up to $1,500 and a HackerOne bug bounty.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 2 pay cash
- Targets in scope
- 106
- 6 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Nextcloud
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Nextcloud
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
Nextcloud
HackerOne · Bug bounty |
– | – | – | – | Not published | – | – | 17 hours average | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
-
- First response
- 17 hours average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
106 targets across all 2 programs, each listed once with the programs that cover it. 14 excluded.
-
Authentication end to end: login, app passwords, device tokens, session handling, every two-factor provider, and the SSO apps user_saml and user_oidc
Products and areas
Covered by Sorona
-
Mail, Calendar and Contacts, each of which parses data formats supplied by remote parties
Products and areas
Covered by Sorona
-
The app store client and the update path, which fetch and install code onto a running server
Products and areas
Covered by Sorona
-
The collaborative editing path through richdocuments and text, and the document conversion behind it
Products and areas
Covered by Sorona
-
The desktop client and the iOS and Android clients, all named in the program's asset list
Products and areas
Covered by Sorona
-
The end-to-end encryption app and the key handling around it, whose entire promise is that the server cannot read the content
Products and areas
Covered by Sorona
-
The OCS API and the app framework every first-party and third-party app is built on
Products and areas
Covered by Sorona
-
The program's declared scope is unusually wide and every asset in it accepts submissions: the server, around seventy first-party apps, the desktop client, the mobile clients, roundcube/roundcubemail, and roughly twenty-five production domains
Products and areas
Covered by Sorona
-
The server core: the file storage abstraction, versions, trashbin and the WebDAV endpoints every client speaks to
Products and areas
Covered by Sorona
-
The sharing and permission model in full, covering link shares, share passwords, expiry, re-sharing, group folders and federated shares between servers
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 14
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
cloud.nextcloud.com
HackerOne
-
conf.nextcloud.com
HackerOne
-
demo.nextcloud.com
HackerOne
-
drone.nextcloud.com
HackerOne
-
https://nextcloud.atlassian.net/jira/dashboard
HackerOne
-
sentry.nextcloud.com
HackerOne
-
try.nextcloud.com
HackerOne
-
daita/files_fulltextsearch_tesseract
HackerOne
-
Any expectation of payment: the policy rules out financial reward for any submission at any severity
Sorona
-
Assets outside the program's published list, since the scope statement enumerates what it covers
Sorona
-
Findings already covered by a published Nextcloud advisory
Sorona
-
Operator deployment configuration, including reverse-proxy setup, storage backends and a server exposed without TLS
Sorona
-
Third-party community apps from the app store that are not among the first-party apps the program names
Sorona
-
Upstream PHP, database engines and library defects, unless Nextcloud's own use of them is what makes the issue reachable
Sorona
Recent changes
Reward and scope changes across every Nextcloud program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Nextcloud products, from the NVD.
-
CVE-2026-45690 Medium
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a te
-
CVE-2026-45722 High
Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or t
-
CVE-2026-45722 High
Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or t
-
CVE-2026-45691 Medium
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication
-
CVE-2026-45810 Medium
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterpri
-
CVE-2026-45691 Medium
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication
-
CVE-2026-45690 Medium
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a te
-
CVE-2026-45810 Medium
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterpri
About this page
This page gathers every public program listed under nextcloud.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.