When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowin…

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-s…

App passwords were allowed to bypass password confirmation on sensitive endpoints.

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextc…

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner …

Nextcloud: Propfind requests for file comments allowed to load comments for other files

Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views

Nextcloud: Bypass of second factor authentication on DAV endpoints

Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay

Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution

Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService

Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share

Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint

Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate

Nextcloud: Hidden Public Link creation when sharing to a Team External Member

Nextcloud: Files Lock app allows users to lock and unlock files of other users

Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access

Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update

Nextcloud: Limited path traversal via template API if using `{lang}` in config

Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass

Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations

Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers

Nextcloud: Missing permission check for from submissions

Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling

Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner

Nextcloud: Valid share tokens allow to access tempory upload files of share owner

Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

Nextcloud: Private circle can be added to another circle via API