Vimeo · disclosed reports
Access Control
13 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Vimeo on HackerOne- reports
- 13
- paid a bounty
- 0
Every one of the 13 is a mark on the map. Named now: 1 to 13, most upvoted first.
- Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv
- Invite any user to your group without even following him
- CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.
- Buying ondemand videos that 0.1 and sometimes for free
- Missing rate limit on private videos password
- A user can post comments on other user's private videos
- A user can add videos to other user's private groups
- A user can edit comments even after video comments are disabled
- Post in private groups after getting removed
- A user can enhance their videos with paid tracks without buying the track
- abusing Thumbnails(https://vimeo.com/upload/select_thumb) to see a private video
- profile photo update bypass
- Share your channel to any user on vimeo without following him
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.