Uber · disclosed reports
Access Control
11 disclosed reports · $5,500 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Uber on HackerOne- reports
- 11
- paid a bounty
- 3
Every one of the 11 is a mark on the map. Named now: 1 to 11, most upvoted first.
- Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.
- Subdomain takeover at signup.uber.com
- Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront
- Subdomain takeover on mta1a1.spmail.uber.com
- 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl )
- Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees
- Improper Access Control on Onelogin in multi-layered architecture
- Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com
- Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII
- Compromising Atlassian Confluence (team.uberinternal.com) via WordPress (newsroom.uber.com)
- Privilege escalation to allow non activated users to login and use uber partner ios app
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.