Guests can continue to receive video streams from call after being removed from a conversation Analysed #1706248 Valid Nextcloud Information Disclosure Medium 2022-12-31 – 15 Invited team member can disclosure slack channels Analysed #509574 Valid HackerOne Information Disclosure Low 2019-04-05 $500 16 DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767) Analysed #3852135 Valid Rocket.Chat SQL Injection High 2026-08-20 – 16 MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service Analysed #3867358 Valid MariaDB Denial of Service Medium 2026-10-07 – 16 Viewer is able to leak the previous versions of the file Analysed #1080700 Valid Lark Technologies Access Control Medium 2022-10-24 – 17 Read-Only user can execute arbitraty shell commands on AirOS Analysed #119317 Valid Ubiquiti Inc. Command and Code Injection – 2016-08-05 – 18 Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server Analysed #3769676 Valid MariaDB Memory Corruption Medium 2026-09-03 – 18 Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed. Analysed #156520 Valid Algolia Authentication – 2016-11-27 $400 19 Any authenticated user can download full list of users, including email Analysed #228399 Valid Discourse Information Disclosure Medium 2017-06-17 $256 19 Read-Only user can delete users Analysed #888729 Valid Helium Insecure Direct Object Reference High 2020-07-10 – 19 Staff Member can Get POS Access Without User Interaction Analysed #1018094 Valid Shopify No weakness recorded Medium 2020-11-19 – 19 Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpoint Analysed #810320 Valid Helium Access Control Medium 2020-06-29 – 21 Reporters can upload design to issues using the "Move to" feature Analysed #1112297 Valid GitLab Access Control Medium 2021-10-18 $600 21 Normal User is able to EXPORT Feature Usage Statistics Analysed #1470076 Valid Lark Technologies Access Control Medium 2022-03-04 – 21 Read-Only user can execute arbitraty shell commands on AirOS Analysed #128750 Valid Ubiquiti Inc. Command and Code Injection – 2016-08-05 – 22 Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist Analysed #2251074 Valid Nextcloud Injection and Smuggling Medium 2024-01-18 – 22 pam-ussh may be tricked into using another logged in user's ssh-agent Analysed #204802 Valid Uber Authentication Medium 2017-03-20 – 23 [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account Analysed #245872 Valid GSA Bounty Insecure Direct Object Reference Medium 2017-09-05 – 23 Low Privileged Staff Member Can Export Billing Charges Analysed #1010835 Valid Shopify Access Control Medium 2020-11-26 $1,900 24 None permission staff member can identify installed application and products attached to it Analysed #848625 Valid Shopify Information Disclosure Low 2020-04-21 $500 26 Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card number Analysed #858662 Valid Starbucks Insecure Direct Object Reference Low 2020-05-19 – 28 Non-admin users can reset app allowlist to the default Analysed #2250398 Valid Nextcloud Input Validation and Logic Medium 2024-01-18 – 28 Guest Users can create issues for Sentry errors and track their status Analysed #1117768 Valid GitLab Access Control Low 2021-09-24 $610 29 Read-only team members can read all properties of webhooks Analysed #818848 Valid HackerOne Access Control Low 2020-04-29 – 30 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet Analysed #3770482 Valid Nextcloud Access Control Medium 2026-09-18 – 31 Apache Airflow Sql injection by authenticated user Analysed #3078856 Valid Internet Bug Bounty SQL Injection Low 2025-05-27 $505 35 Low Privileged user can add or remove cash to/from sales register Analysed #905543 Valid Shopify Access Control Low 2021-06-16 – 37 Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT Analysed #909863 Valid Shopify Insecure Direct Object Reference Medium 2021-02-07 – 38 Read-only users can restore old versions Analysed #1356508 Valid Nextcloud Access Control Medium 2024-06-14 $500 38 html injection via invite members can be leads account takeover Analysed #1443567 Valid Mattermost Cross-site Scripting Low 2022-03-22 – 38 RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logs Analysed #3589551 Valid Rocket.Chat Access Control Medium 2026-04-23 – 40 Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution Analysed #3619409 Valid Monero Access Control High 2026-08-20 – 40 Read-Only user can execute arbitraty shell commands on AirOS Analysed #139398 Valid Ubiquiti Inc. Command and Code Injection – 2016-08-05 – 44 Non privileged user is able to approve his own app himself leading to mass privilege escalations. Analysed #1168475 Valid Lark Technologies Access Control High 2021-11-20 – 45 [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege Analysed #1091303 Valid Shopify Information Disclosure Medium 2021-04-08 – 46 Guest users can create new test cases Analysed #1113289 Valid GitLab Access Control Medium 2021-08-30 $650 49 Customer can cancel a individual booking in a batch, causing locking of partner. Analysed #3295503 Valid Bykea Input Validation and Logic Medium 2025-11-20 – 49 Low-privileged user can enable or disable Lovable AI for new projects in workspace Analysed #3369843 Valid Lovable VDP Access Control Low 2025-11-07 – 56 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid HackerOne Access Control Medium 2023-11-22 – 57 Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business account Analysed #2396571 Valid Yelp Access Control Low 2025-01-28 – 60 A non-privileged user may create an admin account in Stocky Analysed #1245736 Valid Shopify Access Control Medium 2021-11-25 – 67 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid HackerOne Insecure Direct Object Reference Medium 2019-10-25 – 76 Triager/Team members can edit hacker's report and hacker is not even notified Analysed #2061367 Valid HackerOne No weakness recorded Medium 2023-08-31 $2,500 84 View-only guests could see deleted Collectives pages in the trashbin Analysed #3521434 Valid Nextcloud Access Control Low 2026-05-08 – 87 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid HackerOne Access Control High 2024-06-19 – 104 Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML Notifications Analysed #816156 Valid Slack Command and Code Injection High 2021-05-09 – 107 Stored XSS via Post Tittle Enabling Non-Privileged User to Privileged User Exploitation on https://forums.autodesk.com/ Analysed #2974307 Valid Autodesk Cross-site Scripting High 2025-02-26 – 139 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid HackerOne Access Control Low 2024-06-06 – 149 adding h1_analyst_* to username for normal users Analysed #1770797 Valid HackerOne Input Validation and Logic Low 2023-04-12 $500 187