- Top reward
- Not published
- Top severity paid
- Critical
- Assets in scope
- 94
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report on HackerOne
- Submit through the program page.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
HackerOne does not publish a reward table for this program.
- Pays cash
-
No
Please note that Nextcloud does not offer monetary bounties for security reports submitted through this program.
- Hall of fame
-
Yes
Public acknowledgment on the HackerOne platform
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
94 assets you may test, 8 excluded.
Source code 63
- https://github.com/nextcloud/collectives Critical No bounty
- https://github.com/nextcloud/files_confidential Critical No bounty
- https://github.com/nextcloud/tables Critical No bounty
- https://github.com/roundcube/roundcubemail Critical No bounty
- nextcloud/3rdparty Critical No bounty
- nextcloud/activity Critical No bounty
- nextcloud/approval Critical No bounty
- nextcloud/bruteforcesettings Critical No bounty
- nextcloud/calendar Critical No bounty
- nextcloud/calendar_resource_management Critical No bounty
- nextcloud/circles Critical No bounty
- nextcloud/contacts Critical No bounty
- nextcloud/data_request Critical No bounty
- nextcloud/deck Critical No bounty
- nextcloud/end_to_end_encryption Critical No bounty
- nextcloud/external Critical No bounty
- nextcloud/files_accesscontrol Critical No bounty
- nextcloud/files_antivirus Critical No bounty
- nextcloud/files_automatedtagging Critical No bounty
- nextcloud/files_fulltextsearch Critical No bounty
- nextcloud/files_fulltextsearch_tesseract Critical No bounty
- nextcloud/files_lock Critical No bounty
- nextcloud/files_pdfviewer Critical No bounty
- nextcloud/files_retention Critical No bounty
- nextcloud/files_rightclick Critical No bounty
- nextcloud/files_texteditor Critical No bounty
- nextcloud/firstrunwizard Critical No bounty
- nextcloud/flow_notifications Critical No bounty
- nextcloud/fulltextsearch Critical No bounty
- nextcloud/fulltextsearch_elasticsearch Critical No bounty
- nextcloud/globalsiteselector Critical No bounty
- nextcloud/groupfolders Critical No bounty
- nextcloud/guests Critical No bounty
- nextcloud/logreader Critical No bounty
- nextcloud/mail Critical No bounty
- nextcloud/nextcloud_announcements Critical No bounty
- nextcloud/notes Critical No bounty
- nextcloud/notifications Critical No bounty
- nextcloud/notify_push Critical No bounty
- nextcloud/password_policy Critical No bounty
- nextcloud/photos Critical No bounty
- nextcloud/preferred_providers Critical No bounty
- nextcloud/privacy Critical No bounty
- nextcloud/recommendations Critical No bounty
- nextcloud/related_resources Critical No bounty
- nextcloud/richdocuments Critical No bounty
- nextcloud/server Critical No bounty
- nextcloud/serverinfo Critical No bounty
- nextcloud/sharepoint Critical No bounty
- nextcloud/socialsharing Critical No bounty
- nextcloud/spreed Critical No bounty
- nextcloud/survey_client Critical No bounty
- nextcloud/suspicious_login Critical No bounty
- nextcloud/terms_of_service Critical No bounty
- nextcloud/text Critical No bounty
- nextcloud/twofactor_totp Critical No bounty
- nextcloud/twofactor_webauthn Critical No bounty
- nextcloud/updater Critical No bounty
- nextcloud/user_migration Critical No bounty
- nextcloud/user_oidc Critical No bounty
- nextcloud/user_saml Critical No bounty
- nextcloud/viewer Critical No bounty
- nextcloud/workflow_script Critical No bounty
Web 24
- apps.nextcloud.com Critical No bounty
- auth.nextcloud.com Critical No bounty
- crm.nextcloud.com Critical No bounty
- customerupdates.nextcloud.com Critical No bounty
- docs.nextcloud.com Critical No bounty
- download.nextcloud.com Critical No bounty
- help.nextcloud.com Critical No bounty
- knowledge.nextcloud.com Critical No bounty
- lists.nextcloud.com Critical No bounty
- logs.nextcloud.com Critical No bounty
- lookup.nextcloud.com Critical No bounty
- newsletter.nextcloud.com Low No bounty
- nextcloud.com Critical No bounty
- portal.nextcloud.com Critical No bounty
- projects.nextcloud.com Critical No bounty
- pushfeed.nextcloud.com Low No bounty
- push-notifications.nextcloud.com Critical No bounty
- scan.nextcloud.com Critical No bounty
- static.apps.nextcloud.com Critical No bounty
- stats.nextcloud.com Critical No bounty
- support.nextcloud.com Critical No bounty
- surveyserver.nextcloud.com Critical No bounty
- updates.nextcloud.com Critical No bounty
- usercontent.apps.nextcloud.com Critical No bounty
Android apps 3
- com.nextcloud.client Medium No bounty
- com.nextcloud.talk2 Medium No bounty
- it.niedermann.owncloud.notes Medium No bounty
iOS apps 3
- com.nextcloud.Talk Medium No bounty
- com.peterandlinda.iOCNotes Critical No bounty
- it.twsweb.Nextcloud Medium No bounty
Desktop and binaries 1
- Desktop Client Critical No bounty
Out of scope (8)
- daita/files_fulltextsearch_tesseract
- cloud.nextcloud.com
- conf.nextcloud.com
- demo.nextcloud.com
- drone.nextcloud.com
- https://nextcloud.atlassian.net/jira/dashboard
- sentry.nextcloud.com
- try.nextcloud.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Nextcloud (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
We accept only issues that you have reproduced yourself, proven by screenshots.
-
Do not submit a report before reproducing the issue.
-
DO NOT include Personally Identifiable Information (PII) in your report
-
If you use large language models (LLMs), please disclose how you used LLMs
-
Please do not run any Denial of Service attacks against our infrastructure or extract user data.
-
Please do also refrain from using automated testing tools against our infrastructure.
-
Do not disclose bugs to other parties before we have published a patch.
Not accepted
-
Missing X-Frame-Options on the download servers
-
Denial of Service
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-45691 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication | Medium 5.9 | 1 Jun 2026 |
| CVE-2026-45810 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterpri | Medium 6.8 | 1 Jun 2026 |
| CVE-2026-45722 | Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or t | High 7.1 | 1 Jun 2026 |
| CVE-2026-45690 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a te | Medium 5.9 | 1 Jun 2026 |
| CVE-2026-45544 | Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0. | Medium 4.3 | 1 Jun 2026 |
| CVE-2026-45545 | Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitati | High 8.2 | 1 Jun 2026 |
| CVE-2026-45543 | Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7. | Medium 5.3 | 1 Jun 2026 |
| CVE-2026-45284 | Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0. | Medium 4.6 | 1 Jun 2026 |
| CVE-2026-45286 | Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3. | Medium 4.3 | 1 Jun 2026 |
| CVE-2026-45285 | Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the system automatically creates a public link for that external member. This public link is not displayed | Medium 6.4 | 1 Jun 2026 |
| CVE-2026-45283 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tok | Medium 6.3 | 1 Jun 2026 |
| CVE-2026-45279 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is up | Medium 4.4 | 1 Jun 2026 |
| CVE-2026-45282 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions. It is applicable to any file that is shared directly, as the attacker only needs to know a documen | Medium 6.5 | 1 Jun 2026 |
| CVE-2026-45281 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend o | High 8.1 | 1 Jun 2026 |
| CVE-2026-45278 | Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2. | Low 3.3 | 1 Jun 2026 |
| CVE-2026-45277 | Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2. | Low 3.3 | 1 Jun 2026 |
| CVE-2026-45275 | Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in | Medium 6.5 | 1 Jun 2026 |
| CVE-2026-22683 | Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to creat | High 8.7 | 7 Apr 2026 |
| CVE-2025-64011 | Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions. | Medium 4.3 | 12 Dec 2025 |
| CVE-2025-66554 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0. | Low 3.5 | 5 Dec 2025 |
| CVE-2025-66558 | Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next login. The attacker can not authenticate as the v | Low 3.1 | 5 Dec 2025 |
| CVE-2025-66557 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2. | Medium 5.4 | 5 Dec 2025 |
| CVE-2025-66556 | Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2. | Low 3.5 | 5 Dec 2025 |
| CVE-2025-66548 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1. | Low 3.3 | 5 Dec 2025 |
| CVE-2025-66553 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4. | Medium 4.3 | 5 Dec 2025 |
| CVE-2025-66551 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3. | Medium 6.3 | 5 Dec 2025 |
| CVE-2025-66515 | The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0. | Low 2.7 | 5 Dec 2025 |
| CVE-2025-66549 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5. | Low 2.4 | 5 Dec 2025 |
| CVE-2025-66545 | Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2. | Low 3.5 | 5 Dec 2025 |
| CVE-2025-66514 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code. | Low 3.5 | 5 Dec 2025 |
| CVE-2025-66513 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1. | Medium 4.3 | 5 Dec 2025 |
| CVE-2025-66552 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1. | Medium 4.3 | 5 Dec 2025 |
| CVE-2025-66550 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4. | Medium 5.7 | 5 Dec 2025 |
| CVE-2025-66546 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1. | Low 3.3 | 5 Dec 2025 |
| CVE-2025-66512 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page. | Medium 5.4 | 5 Dec 2025 |
| CVE-2025-66511 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3. | Medium 4.8 | 5 Dec 2025 |
| CVE-2025-66510 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are | Medium 4.5 | 5 Dec 2025 |
| CVE-2025-66547 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1. | Medium 4.3 | 5 Dec 2025 |
| CVE-2025-59788 | Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE- | Medium 6.4 | 4 Dec 2025 |
| CVE-2025-47791 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextc | Medium 4.3 | 16 May 2025 |
| CVE-2025-47794 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, | Low 2.6 | 16 May 2025 |
| CVE-2025-47793 | Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed | Medium 4.3 | 16 May 2025 |
| CVE-2025-47792 | Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available. | Medium 5.0 | 16 May 2025 |
| CVE-2025-47790 | Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `rem | Medium 6.4 | 16 May 2025 |
| CVE-2024-52512 | user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0. | Low 3.3 | 15 Nov 2024 |
| CVE-2024-52514 | Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 2 | Medium 4.1 | 15 Nov 2024 |
| CVE-2024-52513 | Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.1 | Low 2.6 | 15 Nov 2024 |
| CVE-2024-52511 | Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0. | Medium 6.3 | 15 Nov 2024 |
| CVE-2024-52508 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like [email protected] that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.1 | High 8.2 | 15 Nov 2024 |
| CVE-2024-52510 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later. | Medium 4.2 | 15 Nov 2024 |
| CVE-2024-52509 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2. | Low 3.5 | 15 Nov 2024 |
| CVE-2024-52507 | Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1. | Low 3.5 | 15 Nov 2024 |
| CVE-2024-52523 | Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and | Medium 4.6 | 15 Nov 2024 |
| CVE-2024-52525 | Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended | Low 1.8 | 15 Nov 2024 |
| CVE-2024-52521 | Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.1 | Low 2.6 | 15 Nov 2024 |
| CVE-2024-52519 | Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. | Low 2.7 | 15 Nov 2024 |
| CVE-2024-52520 | Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. | Medium 5.7 | 15 Nov 2024 |
| CVE-2024-52518 | Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. | Medium 4.4 | 15 Nov 2024 |
| CVE-2024-52517 | Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded | Medium 4.6 | 15 Nov 2024 |
| CVE-2024-52516 | Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6. | Low 3.0 | 15 Nov 2024 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
We're inviting researchers all over the globe to take a look at Nextcloud and bring its security to the next level. If you're interested in learning how we handle security you can read more about it on our dedicated security page.
Important notice ⚠️
No monetary bounties
Please note that Nextcloud does not offer monetary bounties for security reports submitted through this program.
Due to the large amount of AI-generated illegitimate reports, we have temporarily suspended our paid bounty program and no financial rewards will be awarded for any submissions, regardless of severity. We remain deeply committed to security and to working with the research community. Valid reports will still be triaged, fixed, and publicly acknowledged after disclosure, and reporters will continue to receive recognition through this platform. We greatly appreciate the time and effort that researchers invest in helping us keep Nextcloud secure.
As you are likely aware, this is an industry-wide challenge and like others, we have been unable to find ways to responsibly handle the massive increase of low quality reports. We hope to be able to restart the program once a reliable approach to filtering out the low-effort reports has been found. We have already engaged with HackerOne on this and will continue to do so.
AI-generated reports
Given the high number of generic AI security reports, we are emphasizing the following:
- We accept only issues that you have reproduced yourself, proven by screenshots.
- Do not submit a report before reproducing the issue.
Low-effort AI-generated reports will be ignored and closed as Spam (-10 reputation) and may lead to your suspension from this program.
Program policy
- Keep your reports short and concise, only include the relevant information about what the threat is and how to reproduce it. Do not overexaggerate your reports.
- DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.
- Same rule apply to with secrets, keys and credentials.
- If you use large language models (LLMs), please disclose how you used LLMs, and carefully review and edit its output before you send it to us. Please double-check that your reproduction steps actually work and that all the information you include in the report is valid and correct.
- Don't leak the contents of your report up front to any SaaS solutions, such as AI services like ChatGPT, search engines, browser plugins, or translation engines. If you use services, such as large language models, only use services that run locally on your own hardware to ensure our security information does not leak to the outside world.
- All reports must be validated manually, submission from automated tools (code analysis tools, AI, …) won't be considered unless manually reviewed and validated from your side.
- If your report mostly contains "AI slop reports" (in other words reports that are generated largely by LLMs) or is auto generated, without careful review from you and thus result in additional work on our side or even invalid reports, we consider the following actions a valid option:
- 🔒 Closing your reports as Spam
- ⛔ Block you from our program
Instead of bothering you with a huge list of exclusions we're going to tell you what we're especially looking after:
- Bugs within Nextcloud server and apps supported by Nextcloud GmbH (Note: see Scope list for all qualifying and packaged components. Third-party apps from the AppStore are not part of our program.)
- Please check the top of our wiki for Current version to see which Nextcloud Server versions are eligible: https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule
- For Apps only the latest version compatible with those Nextcloud Server versions are eligible
- Reports that do not mention a Nextcloud Server version or the App version where applicable will be closed as N/A"
- Bugs within the mobile iOS and Android sync clients
- Only the latest version of each client available in the respective store is eligible
- Bugs within the desktop clients for Mac, Windows, and Linux
- Only the latest version of each client is eligible
For us a bug is something that actively allows an attacker to escalate their privileges. Something like "Attacker can delete arbitrary files of other users" is fine to be reported, "Missing X-Frame-Options on the download servers" not so much. At the moment we are also considering "Denial of Service" out of scope, we will acknowledge you though!
Found a security bug in one of the mentioned scopes? Awesome! Just report it here and we will get back to you. Bonus points if you check back with our threat model before.
Found a bug in one of our websites or app that is not in scope? We will acknowledge the issue and happily accept reports for it via this platform as well.
- Please do not run any Denial of Service attacks against our infrastructure or extract user data.
- Please do also refrain from using automated testing tools against our infrastructure.
- Do not disclose bugs to other parties before we have published a patch.
We believe in transparency about our security, so any valid vulnerabilities discovered are always publicly disclosed after a grace period.
Disclosure guideline
We are committed to resolving reported vulnerabilities promptly. Our target is to provide a resolution within 90 days of triage. We ask reporters not to disclose any details about the vulnerability until a fix has been released or the 90-day resolution window has elapsed. All communication regarding the vulnerability, including status updates, clarifications, and disclosure requests should happen within the HackerOne platform. Please do not reach out through other public or private channels.
Recognition
While we no longer offer monetary rewards, we recognize the contributions of security researchers in the following ways:
- Public acknowledgment on the HackerOne platform
- Reputation points for valid reports
- Credit in our security advisories upon disclosure (where applicable and with your consent)
Thank you for helping us keep Nextcloud and its users secure.