LinkedIn · disclosed reports
Insecure Direct Object Reference
12 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open LinkedIn on HackerOne- reports
- 12
- paid a bounty
- 0
Every one of the 12 is a mark on the map. Named now: 1 to 12, most upvoted first.
- Unauthorized User can View Subscribers of Other Users Newsletters
- Unauthorized access to resumes stored on LinkedIn
- IDOR allows an attacker to delete anyone's featured photo.
- An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.
- IDOR to make someone attend or leave an event
- Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per month
- Access to Deactivated LinkedIn Company Pages via Competitor Analytics API
- Can access the job name, creator name and can report any draft/under review/rejected job
- Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning`
- Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewed
- [ Continuation Report from #1814842 ] Can create articles using other users' NewsLetters
- Campaign Account Balance and History Disclosed in API Response
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.