Bug bounty program
LT
Lark Technologies
Most upvoted reports38
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Stored XSS & SSRF in Lark DocsAnalysed#892049 | Server-Side Request Forgery | 2021-02-05 | $3,000 | 178 |
| Server Side Request ForgeryAnalysed#644238 | Server-Side Request Forgery | 2021-03-29 | – | 164 |
| Full read SSRF via Lark Docs `import as docs` featureAnalysed#1409727 | Server-Side Request Forgery | 2022-01-28 | $5,000 | 124 |
| Attacker is able to join any tenant on larksuite and view personal files/chats.Analysed#1363185 | Access Control | 2021-11-03 | – | 84 |
| SSRF with information disclosureAnalysed#810401 | Server-Side Request Forgery | 2021-04-27 | – | 64 |
| [Lark Android] Vulnerability in exported activity WebViewAnalysed#694053 | Cross-site Scripting | 2021-07-22 | $1,000 | 63 |
| Able to steal private files by manipulating response using Compose Email function of LarkAnalysed#1373784 | Insecure Direct Object Reference | 2022-01-25 | – | 50 |
| Reflected xss and open redirect on larksuite.com using /?back_uri= parameter.Analysed#955606 | Cross-site Scripting | 2022-01-13 | – | 49 |
| Sensitive information of helpdesk is being leaked.Analysed#805023 | Access Control | 2021-03-06 | – | 45 |
| Non privileged user is able to approve his own app himself leading to mass privilege escalations.Analysed#1168475 | Access Control | 2021-11-20 | – | 45 |
Subdomains1,634
| Name | Scope | First seen |
|---|---|---|
| j17-corp.larksuite.cominternal | Not in the scope | 2026-11-14 |
| nct-corp.larksuite.cominternal | Not in the scope | 2026-11-14 |
| internal-api.larksuite.comapi, internal | In scope | 2026-11-14 |
| internal-api-space.larksuite.comapi, internal | Not in the scope | 2026-11-14 |
| internal-api-sentry.larksuite.comapi, internal, monitoring | Not in the scope | 2026-11-14 |
| internal-api-lark-api.larksuite.comapi, internal | In scope | 2026-11-14 |
| internal-api-security.larksuite.comapi, internal | Not in the scope | 2026-11-14 |
| internal-api-lark-file.larksuite.comapi, internal | Not in the scope | 2026-11-14 |
| internal-api-lark-api-jp.larksuite.comapi, internal | Not in the scope | 2026-11-14 |
| internal-api-lark-api-sg.larksuite.comapi, internal | Not in the scope | 2026-11-14 |
| internal-api-drive-stream.larksuite.comapi, internal | In scope | 2026-11-14 |
| www.internal-api-lark-api.larksuite.comapi, internal | Not in the scope | 2026-11-14 |
| internal-api-drive-stream-sg.larksuite.comapi, internal | Not in the scope | 2026-11-14 |
10 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.