Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Program	Weakness	Severity	Disclosed	Bounty	Votes
Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Analysed#1596663	Valid	Reddit	Access Control	High	2022-11-14	–	186
Program admins could add verified domains to an organizationAnalysed#2323303	Valid	HackerOne	Access Control	Low	2024-03-07	–	83
A malicious admin can be able to permanently disable a Owner(Admin) to access his accountAnalysed#1718574	Valid	Linktree	Insecure Direct Object Reference	Medium	2022-10-25	$600	55
Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groupsAnalysed#3674940	Valid	Nextcloud	Access Control	Medium	2026-09-17	–	36
Admins can change authentication details of user configured external storageAnalysed#2107934	Valid	Nextcloud	Access Control	Low	2023-12-21	$100	31
An organization admin can create an attacker-controlled organization owner via the gem transfer flowAnalysed#3938927	Valid	RubyGems	Access Control	High	2026-10-15	–	27

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.