HackerOne · disclosed reports
Access Control
59 disclosed reports · $19,100 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 59
- paid a bounty
- 12
Every one of the 59 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Email address of any user can be queried on Report Invitation GraphQL type when username is known
- Team member with Program permission only can escalate to Admin permission
- View Titles of Private Reports with pending email invitation
- Account takeover of existing HackerOne accounts through SCIM provisioning
- Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form
- Banned user still has access to their deleted account via HackerOne's API using their API key
- [ Spot Check ] Team members can edit a user's write-up
- Takeover of hackerone.engineering via Github
- Subdomain takeover at info.hacker.one
- Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse
- Ability to access policy and updates for unauthorized program
- Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv
- Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports
- Banned user still able to invited to reports as a collabrator and reset the password
- Program Member Could Duplicate Report To A Non Related Program Original Report
- An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed
- Bypass report submit restriction/ban using the API key
- A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately
- Able to Create Testimonials for myself using Sandbox
- Scope information is leaked when visiting policy scopes tab of any External Program
- Program admins could add verified domains to an organization
- Any one can view collaborater email address via path /reports/<id>/participants
- Subdomain takeover #2 at info.hacker.one
- Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member
- Race condition leads to duplicate payouts
- Non Org Admin/Group Manager can create groups in an organization
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.