Bug bounty program · HackerOne
Most upvoted reports21
- #3400140ValidDenial of Service (DoS) Vulnerability in Drafts Creation EndpointDiscourse · Denial of Service · 2026 · High$1,02498votes
- #423022ValidAccount takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo accountDiscourse · Cross-Site Request Forgery · 2018–89votes
- #3058919ValidApplication Level DoS - Large Markdown Payload in Reply Section Leading to Resource ExhaustionDiscourse · Denial of Service · 2025 · High–84votes
- #242765ValidAny user with invite capabilities can take-over any account on DiscourseDiscourse · No weakness recorded · 2017$1,02475votes
- #260697ValidCSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)Discourse · Cross-Site Request Forgery · 2018–58votes
- #213558ValidArbitrary Local-File Read from Admin - Restore From Backup due to SymlinksDiscourse · Information Disclosure · 2017$51252votes
- #394016ValidWeb Cache Deception Attack (XSS)Discourse · Cross-site Scripting · 2018$25651votes
- #214022ValidAdmin Command Injection via username in user_archive ExportCsvFileDiscourse · Command and Code Injection · 2017$51245votes
- #228377ValidSSRF in upload IMG through URLDiscourse · Information Disclosure · 2017$6432votes
- #3689633ValidHidden/restricted tags can be mutated through synonym ID paths without per-tag authorizationDiscourse · Insecure Direct Object Reference · 2026 · Medium–31votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.