Hackerone Reports

🎯 New Report #3683934: sign multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txset
🔺Severity: High
👽 Reporter: helping bro
⭐️ Reputation: 372
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-19
⏰ Disclosed: 2026-09-17 17:45:03
📝 Summary: The vulnerability in monero-wallet-rpc's sign multisig function allowed a malformed but decryptable multisig transaction set to cause a process crash instead of returning an error. The issue was resolved in version 0.18.5.0.
📂 Report JSON File: 3683934
@hackeronereports

🎯 New Report #3301553: Cross-User Lock/Unlock via Absolute DAV Path
🔺Severity: Medium
👽 Reporter: 0x0doteth
⭐️ Reputation: 1507
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2025-08-16
⏰ Disclosed: 2026-09-17 13:09:01
📝 Summary: A vulnerability was discovered in the files lock app for Nextcloud. The vulnerability allowed any authenticated user to lock or unlock files they did not own by targeting absolute WebDAV paths of other users. This was possible because the DAV plugin resolved files from the absolute request URI without verifying that the user ID path segment matched the authenticated session user. This enabled cross-user manual locks and lock token disclosure, which allowed unauthorized callers to remove token-based locks of other users.
📂 Report JSON File: 3301553
@hackeronereports

🎯 New Report #3533697: Public collectives allow to create pages
🔺Severity: Low
👽 Reporter: yoyomiski
⭐️ Reputation: 1061
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-02-01
⏰ Disclosed: 2026-09-17 10:16:22
📝 Summary: A vulnerability was discovered in the Nextcloud Collectives application that allowed non-members accessing a public collective to create new pages through the backend API, bypassing the collective-level permission settings configured to restrict editing to administrators only. The vulnerability was caused by inconsistent permission enforcement between the user interface, collective settings, and backend API.
📂 Report JSON File: 3533697
@hackeronereports

🎯 New Report #3599383: Arbitrary Board Preference Injection via Deck Config API
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 593
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-12
⏰ Disclosed: 2026-09-17 10:20:08
📝 Summary: A vulnerability was discovered in the Deck Config API of the Nextcloud application that allowed authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating the user's ownership or permission to manage the referenced board.
📂 Report JSON File: 3599383
@hackeronereports

🎯 New Report #3610332: Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 593
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-17
⏰ Disclosed: 2026-09-17 10:34:47
📝 Summary: A vulnerability was discovered in the approval app's file-freshness check. The vulnerability allowed bypassing the check by omitting the etag parameter, enabling approval of unreviewed file changes. This broke the integrity of the approval process, as the approver could approve a different file state than the one they reviewed.
📂 Report JSON File: 3610332
@hackeronereports

🎯 New Report #3674940: Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups
🔺Severity: Medium
👽 Reporter: qloo
⭐️ Reputation: 288
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-04-15
⏰ Disclosed: 2026-09-17 10:41:04
📝 Summary: A critical broken access control vulnerability was discovered in Nextcloud's Group Folders app. The vulnerability allowed an API/REST only delegated admin to bypass folder-level authorization and gain access to any Team Folder by abusing the POST /index.php/apps/groupfolders/folders/{id}/groups endpoint. This was possible because the folder IDs were predictable, allowing the attacker to enumerate all Team Folders and mass-assign their own group, resulting in full access to organization-wide data.
📂 Report JSON File: 3674940
@hackeronereports

🎯 New Report #3506873: Shared smart albums in the Photos app can expose files outside the album owner's configured source folders
🔺Severity: Medium
👽 Reporter: suul
⭐️ Reputation: 1727
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-01-11
⏰ Disclosed: 2026-09-17 10:48:18
📝 Summary: A vulnerability was discovered in a file manager component of a file sharing application. The vulnerability allowed an attacker to access files outside of the intended shared folder by configuring more permissive search paths than the victim intended. This resulted in unauthorized information disclosure, as the system used the attacker's configuration to determine the search scope in the victim's folder. The vulnerability was caused by insufficient validation of the search paths provided by the attacker.
📂 Report JSON File: 3506873
@hackeronereports

🎯 New Report #3303283: Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections
🔺Severity: Medium
👽 Reporter: 0x0doteth
⭐️ Reputation: 1507
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2025-08-18
⏰ Disclosed: 2026-09-17 06:22:37
📝 Summary: A blind SSRF vulnerability was discovered in the Circles app for Nextcloud. The vulnerability allowed unauthenticated users to force the server to fetch internal URLs, bypassing local-address protections in Nextcloud. The vulnerability was caused by the Circles app's signature verification process, which fetched an attacker-provided URL before trust was established.
📂 Report JSON File: 3303283
@hackeronereports

🎯 New Report #3484601: Team membership information returned on API level based on ID
🔺Severity: Low
👽 Reporter: milou
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 200
🕐 Submitted: 2026-01-02
⏰ Disclosed: 2026-09-17 05:49:15
📝 Summary: A vulnerability was discovered in the Nextcloud Circles app that allowed any authenticated user to access membership information for any circle and user combination, regardless of their authorization. The issue stemmed from a lack of permission checks in the affected service and request classes, as well as the public exposure of the vulnerable functionality through an API endpoint. This vulnerability could have led to the disclosure of sensitive organizational data, including private circle memberships, inheritance relationships, and user identification details.
📂 Report JSON File: 3484601
@hackeronereports

🎯 New Report #3633123: Incomplete Input Sanitization in CodeInterpreter install packages Allows Command Injection via pip Flags
🔺Severity: High
👽 Reporter: mistercloudsec
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-28
⏰ Disclosed: 2026-09-16 20:57:22
📝 Summary: The Bedrock AgentCore Python SDK was found to have an incomplete input sanitization vulnerability in the install packages() method. The sanitization process failed to properly handle certain pip flags, such as --index-url, which allowed arbitrary command execution within the Code Interpreter sandbox. This vulnerability was discovered to affect all versions of the bedrock-agentcore-sdk-python up to at least v1.4.8.
📂 Report JSON File: 3633123
@hackeronereports

🎯 New Report #3621588: Authenticated `unsigned txset` change spoof lets a malicious hot wallet steal cold-signer change
🔺Severity: High
👽 Reporter: usagirabbit
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-03-22
⏰ Disclosed: 2026-09-16 09:16:41
📝 Summary: A vulnerability was discovered in Monero's wallet code that allowed a malicious or compromised hot/watch-only wallet with the victim wallet's private view key to forge an authenticated unsigned transaction. The forged transaction included an attacker-controlled output that was presented as change, and the offline signer then reconstructed and signed that output as change. This resulted in a direct loss-of-funds issue, as the resulting output was attacker-spendable and not victim-spendable.
📂 Report JSON File: 3621588
@hackeronereports

🎯 New Report #3771147: Stack Buffer Overflow via Crafted keyseg->start/ keyseg->length in .MYI File (MariaDB MyISAM)
🔺Severity: null
👽 Reporter: lukas kupczyk
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-05-30
⏰ Disclosed: 2026-09-15 09:37:50
📝 Summary: A stack buffer overflow vulnerability was discovered in the MyISAM storage engine of MariaDB. The vulnerability was caused by lack of validation of the "keyseg->start" and "keyseg->length" fields read from the .MYI file. This allowed an attacker to write data beyond the bounds of a fixed-size stack buffer, leading to a denial of service condition when a SQL query touched the affected table's key.
📂 Report JSON File: 3771147
@hackeronereports

🎯 New Report #3771139: Heap Memory Disclosure via Integer Underflow in Item func json arrayagg::cut max length in MariaDB Server
🔺Severity: null
👽 Reporter: lukas kupczyk
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-05-30
⏰ Disclosed: 2026-09-15 09:38:49
📝 Summary: A vulnerability was discovered in the JSON ARRAYAGG aggregate function of MariaDB Server. The vulnerability was caused by an integer underflow in the cut max length function, which could allow an authenticated user to read arbitrary heap memory from the server process. The vulnerability was introduced in commit 6c573a9146caa76807db1190e0747f5befb5b170 (2020-06-15) and affected versions of MariaDB Server prior to 10.5.4.
📂 Report JSON File: 3771139
@hackeronereports

🎯 New Report #3782405: Stack Buffer-Overflow in MariaDB Charset collation map st::insert or replace()
🔺Severity: null
👽 Reporter: lukas kupczyk
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-09-15 09:39:00
📝 Summary: A stack-based buffer overflow was discovered in the MariaDB Server's Charset collation map st::insert or replace() function. The function copied user-supplied charset and collation identifiers into fixed-size stack buffers using strmake() with the attacker-controlled token length as the size bound instead of the destination buffer size. This could have been leveraged by an authenticated user to crash the entire mariadbd process with a single SQL statement.
📂 Report JSON File: 3782405
@hackeronereports

🎯 New Report #3874004: Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get file() leads to command execution
🔺Severity: High
👽 Reporter: mask0ff
⭐️ Reputation: 178
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-19
⏰ Disclosed: 2026-09-15 08:36:07
📝 Summary: A vulnerability was discovered in Weblate, a web-based translation tool. The vulnerability was caused by an incomplete fix for a previous issue (CVE-2022-23915). Weblate passed repository-controlled filenames to Mercurial without properly escaping them, allowing filenames beginning with "-" to be interpreted as command-line options. This could be abused by an authenticated user with project-scoped component-edit permission to inject Mercurial configuration and execute arbitrary commands as the Weblate service account. The vulnerability affected Weblate versions 4.11.1 through 2026.7.1 and was later assigned CVE-2026-86035.
📂 Report JSON File: 3874004
@hackeronereports

🎯 New Report #3771144: Use-After-Free in BTREE Index Traversal via Stale key version in heap update() in MariaDB Server
🔺Severity: null
👽 Reporter: lukas kupczyk
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-05-30
⏰ Disclosed: 2026-09-14 16:05:36
📝 Summary: A use-after-free vulnerability was discovered in the MEMORY (HEAP) storage engine of MariaDB Server. The vulnerability was caused by incorrect handling of the key changed variable in the heap update() function, which could lead to stale pointers being dereferenced during BTREE index traversal. While the vulnerability could be triggered by an authenticated user with standard database privileges, no further details on the potential impact were provided.
📂 Report JSON File: 3771144
@hackeronereports

🎯 New Report #3622877: HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers
🔺Severity: High
👽 Reporter: 1nsomnia1102
⭐️ Reputation: 197
🛠 State: resolved
💼 Team: Cloudflare Public Bug Bounty
💵 Bounty: 1500
🕐 Submitted: 2026-03-23
⏰ Disclosed: 2026-09-14 04:57:45
📝 Summary: A vulnerability was found in Pingora that could allow HTTP request smuggling through improper handling of hop-by-hop headers. The issue was fixed in Pingora 0.9.0.
📂 Report JSON File: 3622877
@hackeronereports

🎯 New Report #3994016: Action Text to markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown
🔺Severity: Medium
👽 Reporter: seoafoz
⭐️ Reputation: 123
🛠 State: resolved
💼 Team: Ruby on Rails
💵 Bounty: null
🕐 Submitted: 2026-09-03
⏰ Disclosed: 2026-09-12 19:08:55
📝 Summary: null
📂 Report JSON File: 3994016
@hackeronereports

🎯 New Report #3709703: Tor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cache
🔺Severity: Low
👽 Reporter: geeknik
⭐️ Reputation: 5998
🛠 State: resolved
💼 Team: Tor
💵 Bounty: null
🕐 Submitted: 2026-05-02
⏰ Disclosed: 2026-09-10 12:10:33
📝 Summary: A vulnerability was discovered in Tor's onion service INTRODUCE2 handling. A remote client could send well-formed INTRODUCE1 cells with an invalid MAC, but a unique byte pattern. The introduction point would forward these cells as INTRODUCE2 to the onion service. The onion service would insert the attacker-controlled encrypted section into the introduction-point replay cache before verifying the INTRODUCE2 MAC. The replay cache was created with no expiration, allowing the attacker to grow it with unauthenticated data until memory pressure or out-of-memory.
📂 Report JSON File: 3709703
@hackeronereports

🎯 New Report #3709605: Conflux-queued zero-length RELAY END triggers heap out-of-bounds read
🔺Severity: Medium
👽 Reporter: geeknik
⭐️ Reputation: 5998
🛠 State: resolved
💼 Team: Tor
💵 Bounty: null
🕐 Submitted: 2026-05-02
⏰ Disclosed: 2026-09-10 12:10:35
📝 Summary: A vulnerability was discovered in Tor that could trigger a heap out-of-bounds read when a zero-length RELAY END cell was processed on a non-open AP stream. The vulnerability was caused by the way Tor handles these cells, where the reason byte was read before checking the message length. This issue was compounded by Conflux's out-of-order delivery, which could copy the zero-length message into an exact-size heap allocation, leading to the out-of-bounds read.
📂 Report JSON File: 3709605
@hackeronereports