- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 275
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
- Hall of fame
-
Yes
Recognition comes as public acknowledgement on the platform, reputation points and credit in the advisory once it is disclosed.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://nextcloud.com
Products and areas 12
- Authentication end to end: login, app passwords, device tokens, session handling, every two-factor provider, and the SSO apps user_saml and user_oidc
- Mail, Calendar and Contacts, each of which parses data formats supplied by remote parties
- Talk, including its signalling, room membership and call setup
- The app store client and the update path, which fetch and install code onto a running server
- The collaborative editing path through richdocuments and text, and the document conversion behind it
- The desktop client and the iOS and Android clients, all named in the program's asset list
- The end-to-end encryption app and the key handling around it, whose entire promise is that the server cannot read the content
- The nextcloud.com production domains the program enumerates
- The OCS API and the app framework every first-party and third-party app is built on
- The program's declared scope is unusually wide and every asset in it accepts submissions: the server, around seventy first-party apps, the desktop client, the mobile clients, roundcube/roundcubemail, and roughly twenty-five production domains
- The server core: the file storage abstraction, versions, trashbin and the WebDAV endpoints every client speaks to
- The sharing and permission model in full, covering link shares, share passwords, expiry, re-sharing, group folders and federated shares between servers
Out of scope (6)
- Any expectation of payment: the policy rules out financial reward for any submission at any severity
- Assets outside the program's published list, since the scope statement enumerates what it covers
- Findings already covered by a published Nextcloud advisory
- Operator deployment configuration, including reverse-proxy setup, storage backends and a server exposed without TLS
- Third-party community apps from the app store that are not among the first-party apps the program names
- Upstream PHP, database engines and library defects, unless Nextcloud's own use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Submit through hackerone.com/nextcloud. The SECURITY.md on nextcloud/server routes everything there and the program is open for submissions
-
Every in-scope asset is flagged not bounty-eligible, and the policy states no financial reward will be awarded for any submission regardless of severity
-
Ignore the instruction attached to the download.nextcloud.com asset, which still promises monetary rewards. It is stale text contradicted by the policy header and by the program's own flags
-
The suspension is self-described as temporary. Check the program's current state before committing a week to it, because this is the entry most likely to flip back
-
The stated reason the money stopped is AI-generated report volume, so a submission that reads like unverified scanner output starts from a bad position
Not accepted
-
Any expectation of payment: the policy rules out financial reward for any submission at any severity
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-45690 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a te | Medium 5.9 | 1 Jun 2026 |
| CVE-2026-45691 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication | Medium 5.9 | 1 Jun 2026 |
| CVE-2026-45722 | Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or t | High 7.1 | 1 Jun 2026 |
| CVE-2026-45810 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterpri | Medium 6.8 | 1 Jun 2026 |
| CVE-2026-45543 | Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7. | Medium 5.3 | 1 Jun 2026 |
| CVE-2026-45544 | Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0. | Medium 4.3 | 1 Jun 2026 |
| CVE-2026-45545 | Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitati | High 8.2 | 1 Jun 2026 |
| CVE-2026-45283 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tok | Medium 6.3 | 1 Jun 2026 |
| CVE-2026-45284 | Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0. | Medium 4.6 | 1 Jun 2026 |
| CVE-2026-45285 | Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the system automatically creates a public link for that external member. This public link is not displayed | Medium 6.4 | 1 Jun 2026 |
| CVE-2026-45286 | Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3. | Medium 4.3 | 1 Jun 2026 |
| CVE-2026-45275 | Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in | Medium 6.5 | 1 Jun 2026 |
| CVE-2026-45277 | Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2. | Low 3.3 | 1 Jun 2026 |
| CVE-2026-45278 | Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2. | Low 3.3 | 1 Jun 2026 |
| CVE-2026-45279 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is up | Medium 4.4 | 1 Jun 2026 |
| CVE-2026-45281 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend o | High 8.1 | 1 Jun 2026 |
| CVE-2026-45282 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions. It is applicable to any file that is shared directly, as the attacker only needs to know a documen | Medium 6.5 | 1 Jun 2026 |
| CVE-2026-22683 | Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to creat | High 8.7 | 7 Apr 2026 |
| CVE-2025-64011 | Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions. | Medium 4.3 | 12 Dec 2025 |
| CVE-2025-66554 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0. | Low 3.5 | 5 Dec 2025 |
| CVE-2025-66556 | Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2. | Low 3.5 | 5 Dec 2025 |
| CVE-2025-66557 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2. | Medium 5.4 | 5 Dec 2025 |
| CVE-2025-66558 | Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next login. The attacker can not authenticate as the v | Low 3.1 | 5 Dec 2025 |
| CVE-2025-66515 | The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0. | Low 2.7 | 5 Dec 2025 |
| CVE-2025-66545 | Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2. | Low 3.5 | 5 Dec 2025 |
| CVE-2025-66548 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1. | Low 3.3 | 5 Dec 2025 |
| CVE-2025-66549 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5. | Low 2.4 | 5 Dec 2025 |
| CVE-2025-66551 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3. | Medium 6.3 | 5 Dec 2025 |
| CVE-2025-66553 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4. | Medium 4.3 | 5 Dec 2025 |
| CVE-2025-66513 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1. | Medium 4.3 | 5 Dec 2025 |
| CVE-2025-66514 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code. | Low 3.5 | 5 Dec 2025 |
| CVE-2025-66550 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4. | Medium 5.7 | 5 Dec 2025 |
| CVE-2025-66552 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1. | Medium 4.3 | 5 Dec 2025 |
| CVE-2025-66510 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are | Medium 4.5 | 5 Dec 2025 |
| CVE-2025-66511 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3. | Medium 4.8 | 5 Dec 2025 |
| CVE-2025-66512 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page. | Medium 5.4 | 5 Dec 2025 |
| CVE-2025-66546 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1. | Low 3.3 | 5 Dec 2025 |
| CVE-2025-66547 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1. | Medium 4.3 | 5 Dec 2025 |
| CVE-2025-59788 | Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE- | Medium 6.4 | 4 Dec 2025 |
| CVE-2025-47791 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextc | Medium 4.3 | 16 May 2025 |
| CVE-2025-47792 | Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available. | Medium 5.0 | 16 May 2025 |
| CVE-2025-47793 | Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed | Medium 4.3 | 16 May 2025 |
| CVE-2025-47794 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, | Low 2.6 | 16 May 2025 |
| CVE-2025-47790 | Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `rem | Medium 6.4 | 16 May 2025 |
| CVE-2024-52511 | Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0. | Medium 6.3 | 15 Nov 2024 |
| CVE-2024-52512 | user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0. | Low 3.3 | 15 Nov 2024 |
| CVE-2024-52513 | Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.1 | Low 2.6 | 15 Nov 2024 |
| CVE-2024-52514 | Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 2 | Medium 4.1 | 15 Nov 2024 |
| CVE-2024-52507 | Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1. | Low 3.5 | 15 Nov 2024 |
| CVE-2024-52508 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like [email protected] that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.1 | High 8.2 | 15 Nov 2024 |
| CVE-2024-52509 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2. | Low 3.5 | 15 Nov 2024 |
| CVE-2024-52510 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later. | Medium 4.2 | 15 Nov 2024 |
| CVE-2024-52521 | Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.1 | Low 2.6 | 15 Nov 2024 |
| CVE-2024-52523 | Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and | Medium 4.6 | 15 Nov 2024 |
| CVE-2024-52525 | Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended | Low 1.8 | 15 Nov 2024 |
| CVE-2024-52518 | Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. | Medium 4.4 | 15 Nov 2024 |
| CVE-2024-52519 | Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. | Low 2.7 | 15 Nov 2024 |
| CVE-2024-52520 | Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. | Medium 5.7 | 15 Nov 2024 |
| CVE-2024-52516 | Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6. | Low 3.0 | 15 Nov 2024 |
| CVE-2024-52517 | Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded | Medium 4.6 | 15 Nov 2024 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 48 Last 12 months 275 Lifetime Access control 35 % Info disclosure 25 % Auth bypass 20 % XSS 20 % Latest advisories Loading the feed Overview Nextcloud is the largest self-hosted file sync and groupware footprint anywhere outside WordPress, at 1.02 billion Docker pulls, running across universities and public-sector estates as well as every homelab that wanted Google Drive without Google. An install is the server plus roughly seventy first-party apps covering chat, mail, calendar and collaborative documents, so the surface is a whole productivity suite behind one login. Nextcloud paid bounties on HackerOne from 2016 until April 2026, when it suspended the paid program over the volume of AI-generated reports and became an unpaid VDP. Recognition is now reputation points and advisory credit, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The program's declared scope is unusually wide and every asset in it accepts submissions: the server, around seventy first-party apps, the desktop client, the mobile clients, roundcube/roundcubemail, and roughly twenty-five production domains The server core: the file storage abstraction, versions, trashbin and the WebDAV endpoints every client speaks to The sharing and permission model in full, covering link shares, share passwords, expiry, re-sharing, group folders and federated shares between servers Authentication end to end: login, app passwords, device tokens, session handling, every two-factor provider, and the SSO apps user_saml and user_oidc Talk, including its signalling, room membership and call setup Mail, Calendar and Contacts, each of which parses data formats supplied by remote parties The collaborative editing path through richdocuments and text, and the document conversion behind it The end-to-end encryption app and the key handling around it, whose entire promise is that the server cannot read the content The OCS API and the app framework every first-party and third-party app is built on The app store client and the update path, which fetch and install code onto a running server The desktop client and the iOS and Android clients, all named in the program's asset list The nextcloud.com production domains the program enumerates Out of scope Assets outside the program's published list, since the scope statement enumerates what it covers Third-party community apps from the app store that are not among the first-party apps the program names Upstream PHP, database engines and library defects, unless Nextcloud's own use of them is what makes the issue reachable Operator deployment configuration, including reverse-proxy setup, storage backends and a server exposed without TLS Findings already covered by a published Nextcloud advisory Any expectation of payment: the policy rules out financial reward for any submission at any severity Most-valued findings Anything that crosses a share boundary, whether reading, writing or deleting a file the sharing model was supposed to gate. That model is the product, and it is the class the whole estate depends on Unauthenticated access to the WebDAV or OCS endpoints, which every client, every script and every mobile app talks to Credential handling around app passwords and device tokens, in particular a long-lived credential that outlives the session or the revocation it was subject to Identity binding in user_saml and user_oidc, where an attacker-controlled identity attaches to an existing account and takes over a user's entire storage Anything that recovers plaintext, keys or metadata from the end-to-end encryption app, since the server is only ever supposed to hold ciphertext Server-side request forgery out of federation, remote share setup, link previews or any other outbound fetch the server makes on a user's behalf Talk signalling and room membership defects, where an uninvited participant reaches a conversation or a call Parsing bugs in Mail, Calendar and Contacts, which process formats that arrive from parties the user never authorised App framework defects that are exploitable across many of the seventy first-party apps at once rather than in a single one Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Submit through hackerone.com/nextcloud. The SECURITY.md on nextcloud/server routes everything there and the program is open for submissions Every in-scope asset is flagged not bounty-eligible, and the policy states no financial reward will be awarded for any submission regardless of severity Ignore the instruction attached to the download.nextcloud.com asset, which still promises monetary rewards. It is stale text contradicted by the policy header and by the program's own flags The suspension is self-described as temporary. Check the program's current state before committing a week to it, because this is the entry most likely to flip back Scope is wide: nextcloud/server , around seventy first-party apps, the desktop client, the iOS and Android clients, roundcube/roundcubemail , and roughly twenty-five nextcloud.com production domains The stated reason the money stopped is AI-generated report volume, so a submission that reads like unverified scanner output starts from a bad position Disclosure Coordinated through HackerOne with the Nextcloud security team and published as a Nextcloud advisory carrying a CVE from the project's own feed rather than as a GitHub advisory. The zero GHSA count on nextcloud/server is a channel artifact rather than a quiet year. Recognition comes as public acknowledgement on the platform, reputation points and credit in the advisory once it is disclosed. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability