GitHub · disclosed reports
Access Control
14 disclosed reports · $10,000 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open GitHub on HackerOne- reports
- 14
- paid a bounty
- 1
Every one of the 14 is a mark on the map. Named now: 1 to 14, most upvoted first.
- Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api
- SAML Signature verification bypass allows logging into any user (with specific conditions)
- Authentication bypass on gist.github.com through SSH Certificates
- Github app Privilege Escalation to Administrator/Owner of the Organization
- GitHub Apps can access suspended installations via scoped user-to-server tokens
- GitHub scoped user to server tokens can escape their installation
- View private repository NWO of deploy key via internal LFS API
- GitHub user to server tokens can create issues in any public repository
- PATs without the required scope can leak issues
- Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository Transfer
- GHES Management console EoP (editor to site admin)
- Managing Pages
- [PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissions
- [PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permission
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.