ownCloud – Bug Bounty Program
Bounty Range
$50 - $5,000
external program
Bounty Range
$50 - $5,000
external program
BountyHall of fame
$50 Low $500 Medium $1,000 High $3,000 Critical $5,000
Avg reward -
Max reward -
Scopes22
Supported languagesEnglish
Reports447
1st response < 1 day
Reports last 24h4
Reports last week37
Reports this month114
Program description
Program activity
Enabled Leaks and exposed credentials
Enabled Systemic Issues grid
Added clarification on the relation between our open source repositories on Github.com and vulnerability reports on YesWeHack.com.
Streamlined some of the program rules and descriptions related to the reward grid without changing the grid itself or the bounty value.
We created the ownCloud Security Bug Bounty Program to reward security researchers for finding issues in the ownCloud Server, and in so doing help strengthen ownCloud Server for customers, users and the community.
Please adhere to the following rules while performing research on this program:
Denial of service (DoS) attacks on ownCloud applications, servers, networks or infrastructure are strictly forbidden.
Avoid tests that could cause degradation or interruption of our services.
Do not use automated scanners or tools that generate large amount of network traffic.
Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
Do not copy any files from our applications/servers and disclose them.
No vulnerability disclosure, full, partial or otherwise, is allowed.
We are happy to thank everyone who submits valid reports which help us improve the security of ownCloud, however only those that meet the following eligibility requirements may receive a monetary reward:
You must be the first reporter of a vulnerability.
The vulnerability must be a qualifying vulnerability (see below).
The report must contain the following elements:
Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and ownCloud, and remediation advice on fixing the vulnerability
Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact
Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc
You must not break any of the testing policy rules listed above
You must not be a former or current employee of ownCloud or one of its contractors.
Reward amounts are based on:
Reward grid of the report's scope
CVSS scoring and actual business impact of the vulnerability upon performing risk analysis
Please note that for any reports involving Cross-Site Scripting (XSS), a basic proof-of-concept such as a JavaScript alert box (e.g., alert(1)) will not be considered sufficient for triage or reward. To qualify for a valid report, you must demonstrate a clear and actionable impact resulting from the XSS vulnerability. This includes, but is not limited to:
Performing actions on behalf of another user (e.g., creating a new user account or modifying user settings)
Exfiltrating sensitive data (e.g., sending authentication cookies or session tokens to an external server)
Bypassing security controls or escalating privileges
The goal is to understand the real-world risk and exploitability of the issue, so please ensure your report includes a well-documented and impactful demonstration.
As you are aware, our software is open source on Github.com. While we absolutely appreciate your contribution to these repositories, we need to clarify the relation to bug bounty reward eligibility.
If you report a vulnerability on YesWeHack.com and also want to suggest a fix in the Github repository, please make sure that you submit the vulnerability report in this program first. As all commits on Github.com are public, we cannot accept a report and pay bounty if the fix was publicly submitted first as it is very hard for us to confirm that you are actually the author of the commit/pull request. If the bug bounty report was submitted after the commit/pull request, we will close it as Duplicate with a reference to the Github issue/fix/commit/PR.
If the team decides to accept a pull request and merges a code change, this does not imply that we acknowledge any vulnerability that is closed with the code change. We accept code improvements for various reasons that are much broader than the reward eligibility in this program. That means that only the rules of this program and the discussion in the report's comment section on YesWeHack.com can root a decision for a bug bounty.
If the bug is identified as meaningful and qualifies for the program, and the reporter has followed the Disclosure Policy, the bug bounty is paid out strictly based on the CVSS score and the documented reward grid. Please note that we linearly interpolate the payout based on the upper and lower borders' values.
The severity of the bug is determined at the discretion of ownCloud and the ownCloud security team. All bounties will be paid using YesWeHack platform.
In ownCloud we consider a vulnerability to be critical only if it poses an immediate threat to a significantly large percentage of our customer base. In that light, vulnerabilities that require administrator privileges (CVSS PR:H) are, by definition, considered a localized threat, and would not be classified as critical. Please note that we would down-rate such vulnerabilities to a maximum of CVSS 8.9, unless provided with compelling arguments, or if chained with another vulnerability that allows privileges escalation.
Issues affecting the Desktop Client available from https://owncloud.org/install/#install-clients
Note that the ownCloud server itself is considered a trusted endpoint in our threat model and an eligible vulnerability must not rely on a malicious ownCloud instance.
Our official Android client from https://play.google.com/store/apps/details?id=com.owncloud.android..
Note that the ownCloud server itself is considered a trusted endpoint in our threat model and an eligible vulnerability must not rely on a malicious ownCloud instance.
Our official iOS client from https://apps.apple.com/app/id1359583808
Note that the ownCloud server itself is considered a trusted endpoint in our threat model and an eligible vulnerability must not rely on a malicious ownCloud instance.
This apps makes it possible for users to create their own custom groups and manage members. It is then possible to share files or folders with these groups.
Create a guest user by typing his name in to the sharing dialog. The guest will receive an email invite with a link to create an account. He only has access to files which are shared with him.
Collabora Online for ownCloud provides collaborating editing functions for text documents, spreadsheets and presentations inside ownCloud for improved productivity.
Notification backend and UI for the notification panel/icon. Used for notifications of other apps (announcementcenter, federatedfilesharing etc.)
This is our core server software, which is "the heart" of owncloud.
Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced file is thus also existent in our final releases.
Media gallery for ownCloud which includes previews for all media types supported by your installation.
Provides a dedicated view of all images in a grid, adds image viewing capabilities to the files app and adds a gallery view to public links.
This is next generation server software, which is "the new heart" of owncloud.
Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced file is thus also existent in our final releases.
This is the web application for the next generation server software, ownCloud Infinite Scale.
Additional web apps for ownCloud Infinite Scale
This application enables administrators to connect ownCloud to an LDAP-based user directory for authentication and provisioning users, groups and user attributes. Admins can configure this application to connect to one or more LDAP directories or Active Directories via an LDAP interface. Attributes such as user quota, email, avatar pictures, group memberships and more can be pulled into ownCloud from a directory with the appropriate queries and filters.
Application for using OAuth 2.0 in ownCloud
OpenID Connect integration for ownCloud 10
Provides an activity feed showing your file changes and other interesting things going on in your ownCloud.
Administrators can impersonate the identity of other users. This is usually used to handle support cases.
This is the app for owncloud file management.
Asset value | CVSS Low | CVSS Medium | CVSS High | CVSS Critical | Critical | $500 | $1,000 | $3,000 | $5,000 |
1st report100% 2nd report100% 3rd report75% 4th report50% 5th report25% 6th+ report10%
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:
More info
Scope | Type | Asset value | Expand rewards grid | https://owncloud.org/install/#install-clients | Application | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://play.google.com/store/apps/details?id=com.owncloud.android | Mobile application Android | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://apps.apple.com/app/id1359583808 | Mobile application IOS | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/customgroups | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/guests | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/richdocuments | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/notifications | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/client | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/core | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/gallery | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/ocis | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/web | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/web-extensions | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/user_ldap | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/oauth2 | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/openidconnect | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/activity | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/impersonate | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/updater | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/core/tree/master/apps/files | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/android | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://github.com/owncloud/ios-app | Other | Critical | | Low $500
Medium $1,000
High $3,000
Critical $5,000
|
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:
More info
Type of leak Source of leak is in-scope Source of leak belongs to the Organization and is out-of-scope Source of leak does not belong to the Organization and is out-of-scope
Impact is in-scope (e.g. valid credentials on an in-scope asset) Eligible Eligible Not eligible
Impact is out-of-scope (e.g. valid credentials for an out-of-scope asset) Eligible Not eligible Not eligible
No test accounts will be provided.
Please append to your user-agent header the following value: ' -BugBounty-owncloud-31337 '.
When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.
For more information, see [https://helpcenter.yeswehack.io/hunter/hunter-collaboration](help center). Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.
To submit a vulnerability report, you need to login with your hunter account. /programs/owncloud-bug-bounty-program/create-report