# Nextcloud domain and name of every user leaked to lookup server

Nextcloud's VerifyUserData background job sends every local user's cloudId (username@domain) to the global lookup server even with federation disabled, leaking user lists and instance domain.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: leonklingele
- Disclosed: 2019-11-26
- CVE: CVE-2019-15623
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/508490
- Library page: https://bugbountylibrary.com/r/h1%3A508490
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:info-disclosure

**Target:** Nextcloud server background job (settings/BackgroundJobs/VerifyUserData.php) querying the federated lookup server
**Root cause:** The VerifyUserData background job unconditionally queries the global lookup server with each user's cloudId regardless of whether federated cloud sharing is disabled, so usernames and the instance domain are transmitted to a third party.
**Steps:**
1. Patch VerifyUserData.php to set `$maxTry = PHP_INT_MAX` and `$interval = 1`, and add `printf('Lookup server response for cloudId=%s: %s' . PHP_EOL, $cloudId, print_r($lookupServerData, true));` after `queryLookupServer($cloudId)`
2. Run cron from CLI: `sudo -u www-data php -f /path/to/nextcloud/cron.php`
3. Observe output listing `cloudId=<username>@<domain>:<port>` for every user, confirming each cloudId was sent to the lookup server
**How found:** Researcher instrumented the VerifyUserData background job to log the cloudId passed to queryLookupServer and noticed every local user's cloudId was being transmitted despite federation being disabled.
**Exploitation:** Passive privacy leak: the lookup server (and anyone observing its traffic) receives the domain and full user list of every Nextcloud instance with internet access, even when all Federated Cloud Sharing options are disabled.
**Insight:** Background/cron jobs that phone home to a central lookup or telemetry service often ignore admin feature toggles; instrument the outbound call arguments to see exactly what identifiers leave the instance.