X / xAI · disclosed reports
Access Control
18 disclosed reports · $8,960 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open X / xAI on HackerOne- reports
- 18
- paid a bounty
- 6
Every one of the 18 is a mark on the map. Named now: 1 to 18, most upvoted first.
- Read-only application can publish/delete fleets
- Private list members disclosure via GraphQL
- Discoverability by phone number/email restriction bypass
- Verify any unused email address
- Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect
- Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpoint
- Ability to see hidden likes
- Subdomain takeover on dev-admin.periscope.tv
- Periscope-all Firebase database takeover
- [IDOR][translate.twitter.com] Opportunity to change any comment at the forum
- 2 Subdomains Takeover at readfu.com
- Remote 0click exfiltration of Safari user's IP address
- PI leakage By Brute Forcing and Phone number deleting without using password
- Insecure Direct Object Reference - access to other user/group DM's
- Fabric.io: Ex-admin of an organization can delete team members
- fabric.io - app member can make himself an admin
- Can see private tweets via keyword searches on tweetdeck
- Fabric.io - an app admin can delete team members from other user apps
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.