Permission Model filesystem over-grant via wildcard radix lookup

🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: malikhamzaiqbal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 7:06am (UTC)
🐞 Source: HackerOne

A flaw was discovered in Node.js Permission Model filesystem enforcement that allowed access to be granted to paths not matching wildcard read or write rules. When a requested path was shorter than the prefix of a wildcard grant, the radix tree lookup would stop comparing early and incorrectly treat the path as a match. This issue affected wildcard grants positioned directly under the root of the permission tree…

👉 Read full report

Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: christos_eth
🔹 State: ⚪️ Informative
🔹 Disclosed: October 27, 2026, 7:53am (UTC)
🐞 Source: HackerOne

👉 Read full report

No password confirmation required when using apptoken on sensitive endpoint

🔹 Severity: Medium
🔹 Weakness: Improper Privilege Management
🔹 Reported To: Nextcloud
🔹 Reported By: npc
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 10:40am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Persistent Denial-of-Service via Federated Share Injection

🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Nextcloud
🔹 Reported By: ncsc_nl
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 10:43am (UTC)
🐞 Source: HackerOne

👉 Read full report

Public shares remain accessible via alternate endpoints after owner account is disabled

🔹 Severity: Medium | 💰 270 USD
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: blinkyyy
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 10:50am (UTC)
🐞 Source: HackerOne

👉 Read full report

Files Confidential tagging can be bypassed with # in filename

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: xavlimsg
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:00am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthorised access with hidden public link creation when sharing to a Team External Member

🔹 Severity: Low | 💰 100 USD
🔹 Weakness: Privilege Escalation
🔹 Reported To: Nextcloud
🔹 Reported By: fadalika
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:10am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the sharing functionality where unauthorized access could be gained through the creation of hidden public links when sharing content to a team external member.

👉 Read full report

Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:17am (UTC)
🐞 Source: HackerOne

👉 Read full report

Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API

🔹 Severity: Low
🔹 Weakness: Information Disclosure
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:19am (UTC)
🐞 Source: HackerOne

👉 Read full report

Tables application does not respect sharing limitations set by admin

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: samin_zavarkesh
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:22am (UTC)
🐞 Source: HackerOne

👉 Read full report

SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards

🔹 Severity: Medium | 💰 250 USD
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Nextcloud
🔹 Reported By: alex-elttam
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:26am (UTC)
🐞 Source: HackerOne

👉 Read full report

FederationController::remoteWopiToken() returns full Wopi entity without token type validation

🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: bornwinnerrr
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

Authorization flaw allows Bugcrowd staff to create customer only comments via API

🔹 Severity: Low
🔹 Reported To: Bugcrowd
🔹 Reported By: drunkrhin0
🔹 State: 🟠 Unresolved
🔹 Disclosed: October 27, 2026
🐞 Source: Bugcrowd

👉 Read full report

Launchpad file read leaks production keys

🔹 Severity: Critical
🔹 Weakness: Path Traversal
🔹 Reported To: Basecamp
🔹 Reported By: bl0rph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:53am (UTC)
🐞 Source: HackerOne

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted.

👉 Read full report

Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

🔹 Severity: High
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:58am (UTC)
🐞 Source: HackerOne

A cross-account cross-site scripting vulnerability was discovered in an embed display endpoint that rendered attacker-supplied HTML verbatim on the application origin without proper authentication checks. The vulnerability could be exploited by crafting a malicious embed with injected HTML and JavaScript that would execute with the victim's privileges when the embed was accessed. The vulnerability was chained with…

👉 Read full report

GraphQL read resolvers and Metabase embed endpoint return full business data to Viewer role

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

GraphQL label settings operations allow Viewer role changes

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Account Takeover on NASA SMCE Identity Provider (Keycloak CVE-2026-18963)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Shisones
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Reflected XSS in trek.nasa.gov TrekWS /rest/light endpoint via unescaped et (date) parameter

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: itz_madhusankha
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated remote code execution on psg.gsfc.nasa.gov via arbitrary file write from a stack overflow in the PSG continuum module (SURFACE-TYPE)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: metantz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Scan For Good] Unauthenticated Oracle SQL Injection in Solar System Treks Email Check API

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ScanForGood
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report