adding h1_analyst_* to username for normal users Analysed #1770797 Valid HackerOne Input Validation and Logic Low 2023-04-12 $500 187 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid HackerOne Access Control Low 2024-06-06 – 149 Stored XSS via Post Tittle Enabling Non-Privileged User to Privileged User Exploitation on https://forums.autodesk.com/ Analysed #2974307 Valid Autodesk Cross-site Scripting High 2025-02-26 – 139 A non-administrator user can change his email even when it is restricted by an administrator #805943 No longer public Visma Public Access Control – – $250 124 Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML Notifications Analysed #816156 Valid Slack Command and Code Injection High 2021-05-09 – 107 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid HackerOne Access Control High 2024-06-19 – 104 View-only guests could see deleted Collectives pages in the trashbin Analysed #3521434 Valid Nextcloud Access Control Low 2026-05-08 – 87 Triager/Team members can edit hacker's report and hacker is not even notified Analysed #2061367 Valid HackerOne No weakness recorded Medium 2023-08-31 $2,500 84 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid HackerOne Insecure Direct Object Reference Medium 2019-10-25 – 76 Arbitrary File Write as SYSTEM from unprivileged user #583184 Informative Valve Access Control High 2020-01-15 $1,250 71 Unprivileged alliance member is able to recruit new members to his alliance and accepting them (xs1.grepolis.com) #511275 No longer public InnoGames Access Control – – $550 70 A non-privileged user may create an admin account in Stocky Analysed #1245736 Valid Shopify Access Control Medium 2021-11-25 – 67 Privilege Escalation leads to Unauthorized Access to Private Conversations By any Regular user [Read , Edit and Delete] #3103849 Informative Dust Access Control Critical 2025-04-29 – 62 Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business account #2396571 Valid Yelp Access Control Low 2025-01-28 – 60 Organization members can delete reports in teams they have no access to #2203432 Valid HackerOne Access Control Medium 2023-11-22 – 57 Low-privileged user can enable or disable Lovable AI for new projects in workspace #3369843 Valid Lovable VDP Access Control Low 2025-11-07 – 56 ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com) #257335 Valid Unikrn File and Path Handling – 2019-03-04 $25 56 Customer can cancel a individual booking in a batch, causing locking of partner. #3295503 Valid Bykea Input Validation and Logic Medium 2025-11-20 – 49 Guest users can create new test cases #1113289 Valid GitLab Access Control Medium 2021-08-30 $650 49 [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege #1091303 Valid Shopify Information Disclosure Medium 2021-04-08 – 46 Non privileged user is able to approve his own app himself leading to mass privilege escalations. #1168475 Valid Lark Technologies Access Control High 2021-11-20 – 45 Read-Only user can execute arbitraty shell commands on AirOS #139398 Valid Ubiquiti Inc. Command and Code Injection – 2016-08-05 – 44 Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution #3619409 Valid Monero Access Control High 2026-08-20 – 40 RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logs #3589551 Valid Rocket.Chat Access Control Medium 2026-04-23 – 40 BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data #3382343 Informative Nextcloud Insecure Direct Object Reference Medium 2026-04-14 – 40 Removed Guest role user who dosent have access to private project in members able to view jobs #2668302 Informative GitLab Access Control None 2024-09-18 – 38 html injection via invite members can be leads account takeover #1443567 Valid Mattermost Cross-site Scripting Low 2022-03-22 – 38 Read-only users can restore old versions #1356508 Valid Nextcloud Access Control Medium 2024-06-14 $500 38 Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT #909863 Valid Shopify Insecure Direct Object Reference Medium 2021-02-07 – 38 Low Privileged user can add or remove cash to/from sales register #905543 Valid Shopify Access Control Low 2021-06-16 – 37 Listing of Amazon S3 Bucket accessible to any amazon authenticated user (metrics.pscp.tv) #278191 Valid X / xAI Information Disclosure – 2017-11-19 $140 36 Apache Airflow Sql injection by authenticated user #3078856 Valid Internet Bug Bounty SQL Injection Low 2025-05-27 $505 35 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet #3770482 Valid Nextcloud Access Control Medium 2026-09-18 – 31 Read-only team members can read all properties of webhooks #818848 Valid HackerOne Access Control Low 2020-04-29 – 30 Guest Users can create issues for Sentry errors and track their status #1117768 Valid GitLab Access Control Low 2021-09-24 $610 29 Non-admin users can reset app allowlist to the default #2250398 Valid Nextcloud Input Validation and Logic Medium 2024-01-18 – 28 Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card number #858662 Valid Starbucks Insecure Direct Object Reference Low 2020-05-19 – 28 None permission staff member can identify installed application and products attached to it #848625 Valid Shopify Information Disclosure Low 2020-04-21 $500 26 Low Privileged Staff Member Can Export Billing Charges #1010835 Valid Shopify Access Control Medium 2020-11-26 $1,900 24 [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account #245872 Valid GSA Bounty Insecure Direct Object Reference – 2017-09-05 – 23 pam-ussh may be tricked into using another logged in user's ssh-agent #204802 Valid Uber Authentication – 2017-03-20 – 23 Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist #2251074 Valid Nextcloud Injection and Smuggling Medium 2024-01-18 – 22 Read-Only user can execute arbitraty shell commands on AirOS #128750 Valid Ubiquiti Inc. Command and Code Injection – 2016-08-05 – 22 Normal User is able to EXPORT Feature Usage Statistics #1470076 Valid Lark Technologies Access Control Medium 2022-03-04 – 21 Reporters can upload design to issues using the "Move to" feature #1112297 Valid GitLab Access Control Medium 2021-10-18 $600 21 Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpoint #810320 Valid Helium Access Control Medium 2020-06-29 – 21 Listing of Amazon S3 Bucket accessible to any amazon authenticated user (vector-maps-e457472599) #631529 No longer public TomTom Information Disclosure – – – 21 Staff Member can Get POS Access Without User Interaction #1018094 Valid Shopify No weakness recorded Medium 2020-11-19 – 19 Read-Only user can delete users #888729 Valid Helium Insecure Direct Object Reference High 2020-07-10 – 19 Any authenticated user can download full list of users, including email #228399 Valid Discourse Information Disclosure – 2017-06-17 $256 19