Bug bounty program · HackerOne
Most upvoted reports44
- #337755ValidCan delete other user's post and company page postLinkedIn · Access Control · 2023–156votes
- #3475626ValidSession Cookie Leakage via Static Header Field in WebViewerFragmentLinkedIn · Misconfiguration and Insecure Design · 2026 · High–131votes
- #425007ValidPersistent XSS (unvalidated Open Graph embed) at LinkedIn.comLinkedIn · No weakness recorded · 2018–119votes
- #1716300ValidUnauthorized User can View Subscribers of Other Users NewslettersLinkedIn · Insecure Direct Object Reference · 2023–117votes
- #1777095ValidUnauthorized access to resumes stored on LinkedInLinkedIn · Insecure Direct Object Reference · 2022–112votes
- #3151001ValidPrevious commentor on post can still comment even after comment permission is changed to disabledLinkedIn · Access Control · 2026 · Low–112votes
- #2534458ValidCan see phone numbers of others by providing mail addressLinkedIn · Information Disclosure · 2024 · High–111votes
- #3079966ValidHTML Injection in LinkedIn Premium Support ChatLinkedIn · No weakness recorded · 2025 · Low–102votes
- #3235855ValidImproper Access Control - Access to "Active Hiring" (Premium feature) filter resultsLinkedIn · Access Control · 2026 · Medium–100votes
- #1608735ValidIDOR allows an attacker to delete anyone's featured photo.LinkedIn · Insecure Direct Object Reference · 2023–99votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.