Starbucks · disclosed reports
Insecure Direct Object Reference
8 disclosed reports · $0 paid · 7 valid · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Starbucks on HackerOne- reports
- 8
- valid
- 7
- paid a bounty
- 0
Every one of the 8 is a mark on the map. Named now: 1 to 8, most upvoted first.
- Singapore - Account Takeover via IDOR
- China - IDOR on Reservation Staging/Non Production Site - https://reservation.stg.starbucks.com.cn
- Able to purchase a gift card with any amount
- Thailand - Insecure Direct Object Reference permits an unauthorized user to transfer funds from a victim using only the victims Starbucks card
- Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card number
- Singapore - IDOR in campaign.starbucks.com.sg
- India - An Insecure Direct Object Reference (IDOR) allowed unauthorized access to view card index number and monetary balance
- Able to bypass information requirements before launching a Chat.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.