HackerOne · disclosed reports
Insecure Direct Object Reference
19 disclosed reports · $17,500 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 19
- paid a bounty
- 2
Every one of the 19 is a mark on the map. Named now: 1 to 19, most upvoted first.
- How the Bug stole hacking
- IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query
- IDOR allows user to access report details via reference.json endpoint
- Insecure Direct Object Reference (IDOR) - Delete Campaigns
- Attachment disclosure via summary report
- Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint
- IDOR vulnerability in unreleased HackerOne Copilot feature
- IDOR Vulnerability at AddTagToAssets operation name
- Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint
- [IDOR] Improper Access Control on Embedded Submission Form
- Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users
- IDOR on HackerOne Feedback Review
- Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent
- IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs
- Any user with access to program can resume and suspend HackerOne Gateway
- Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details
- IDOR in Bugs overview enables attacker to determine the date range a hackathon was active
- IDOR on Program Visibilty (Revealed / Concealed) against other team members
- Moving a report to a different program doesn't reassign the Custom Field Values
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.