Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
30 of 15,219 reports · $5,270 in bounties · 161 analysed so far
- #1596663ValidAdmin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Reddit · Access Control · 2022 · admin or privileged (title)–186votes
- #2323303ValidProgram admins could add verified domains to an organizationHackerOne · Access Control · 2024 · admin or privileged (title)–83votes
- #2188569ValidPrivilege escalation - Support-Contributor to Support and Product Admin via `/api/v2/██████` . No ADMIN PRIVILEGE required.Zendesk · Access Control · 2023 · admin or privileged (title)–58votes
- #1820953ValidNon-store owners can transfer Shopify-managed domain to another domain providerShopify · Access Control · 2024 · admin or privileged (title)–58votes
- #1718574ValidA malicious admin can be able to permanently disable a Owner(Admin) to access his accountLinktree · Insecure Direct Object Reference · 2022 · admin or privileged (title)$60055votes
- #1084865Valid[h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribeShopify · Access Control · 2024 · admin or privileged (title)–51votes
- #3674940ValidCritical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groupsNextcloud · Access Control · 2026 · Medium · admin or privileged (title)–36votes
- #508493ValidGroup admins can remove arbitrary data from "data" directory (including admin data)Nextcloud · Access Control · 2019 · admin or privileged (title)–32votes
- #2107934ValidAdmins can change authentication details of user configured external storageNextcloud · Access Control · 2023 · admin or privileged (title)$10031votes
- #1538004ValidRead-only administrator can change agent update settingsAcronis · Access Control · 2022 · admin or privileged (title)$20029votes
- #3938927ValidAn organization admin can create an attacker-controlled organization owner via the gem transfer flowRubyGems · Access Control · 2026 · High · admin or privileged (title)–27votes
- #471660ValidStored XSS in Macro Editing - Introduced by Admins to affect AdminsZendesk · Cross-site Scripting · 2019 · admin or privileged (title)–27votes
- #344223Valid[Привязка email к странице] by admin@notify.vk.com | email-floodVK.com · No weakness recorded · 2018 · admin or privileged (title)–13votes
- #1463028Valid[AWC-Pune] - User can download files deleted by Admin using shortcutsLark Technologies · No weakness recorded · 2022 · admin or privileged (title)–11votes
- #351361ValidAdministrator can create user without entering high security modePhabricator · Authentication · 2018 · admin or privileged (title)–11votes
- #199286ValidGroup admin can remove user from all his groups via APINextcloud · No weakness recorded · 2017 · admin or privileged (title)–10votes
- #197436Not checked yetRestricted User is able to edit Alert Conditions of Synthetics Monitors even if Synthetics Permissions is enabled by an adminNew Relic · Authentication · admin or privileged (title)–9votes
- #962895ValidStocky App Administrator can create a backdoor admin account by using an existing POS UserShopify · No weakness recorded · 2020 · admin or privileged (title)–8votes
- #138852Not checked yet[idor] Profile Admin can pin any other user's post on his stream wallPornhub · Authentication · admin or privileged (title)$7507votes
- #97452ValidStaff members with no permission can access to the files, uploaded by the administratorShopify · Access Control · 2016 · admin or privileged (title)$5007votes
- #3642236ValidTables application does not respect sharing limitations set by adminNextcloud · Access Control · 2026 · Medium · admin or privileged (title)–6votes
- #56626ValidShop admin can change external login servicesShopify · Access Control · 2015 · admin or privileged (title)$1,0005votes
- #96890ValidA 'Full access' administrator is able to see the shop owners user detailsShopify · Access Control · 2015 · admin or privileged (title)$5003votes
- #47940ValidTeam admin can add billing contactsSlack · Access Control · 2015 · admin or privileged (title)$2003votes
- #46750ValidTeam admin can change unauthorized team setting (allow_message_deletion)Slack · Access Control · 2015 · admin or privileged (title)$1003votes
- #46747ValidTeam admin can change unauthorized team setting (require_at_for_mention)Slack · Access Control · 2015 · admin or privileged (title)$2003votes
- #43065ValidFabric.io - an app admin can delete team members from other user appsX / xAI · Access Control · 2015 · admin or privileged (title)$1,1203votes
- #782703Not checked yetAccount owner/admin can't actually delete personal users' API keysNew Relic · Misconfiguration and Insecure Design · admin or privileged (title)–2votes
- #304642InformativeAdministrators can add other administratorsConcrete CMS · Access Control · 2020 · admin or privileged (title)–2votes
- #1075540No longer publicLimited access to billing dashboard by Admin and Collaborator in conflict with user role permissions.Doppler · Information Disclosure · admin or privileged (title)–0votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.