weakness in Access Control
Improper Access Control - Generic
772 disclosed reports · $262,470 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
- reports
- 772
- paid a bounty
- 166
Every one of the 772 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Account Takeover via Password Reset without user interactions
- Exfiltrate and mutate repository and project data through injected templated service
- Getting all the CD keys of any game
- Ability to reset password for account
- Publicly accessible Continuous Integration Tool
- One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com
- Reset password link sent over unsecured http protocol
- Full account takeover
- Cross-organization data access in city-mobil.ru
- Attacker is able to access commit title and team member comments which are supposed to be private
- Private list members disclosure via GraphQL
- [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious File
- Exposed proxy allows to access internal reddit domains
- [CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/start
- Organization Takeover
- View Titles of Private Reports with pending email invitation
- Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sg
- Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification
- Account takeover of existing HackerOne accounts through SCIM provisioning
- 1 Click Account Takeover via Auth Token Theft on marketing.hostinger.com
- Discoverability by phone number/email restriction bypass
- Group search leaks private MRs, code, commits
- Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.
- Able to bypass email verification and change email to any other user email
- Admin Management - Login Using Default Password - Leads to Image Upload Backdoor/Shell
- Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.