adding h1_analyst_* to username for normal users Analysed #1770797 Valid HackerOne Input Validation and Logic Low 2023-04-12 $500 187 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid HackerOne Access Control Low 2024-06-06 – 149 Stored XSS via Post Tittle Enabling Non-Privileged User to Privileged User Exploitation on https://forums.autodesk.com/ Analysed #2974307 Valid Autodesk Cross-site Scripting High 2025-02-26 – 139 Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML Notifications Analysed #816156 Valid Slack Command and Code Injection High 2021-05-09 – 107 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid HackerOne Access Control High 2024-06-19 – 104 View-only guests could see deleted Collectives pages in the trashbin Analysed #3521434 Valid Nextcloud Access Control Low 2026-05-08 – 87 Triager/Team members can edit hacker's report and hacker is not even notified Analysed #2061367 Valid HackerOne No weakness recorded Medium 2023-08-31 $2,500 84 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid HackerOne Insecure Direct Object Reference Medium 2019-10-25 – 76 A non-privileged user may create an admin account in Stocky Analysed #1245736 Valid Shopify Access Control Medium 2021-11-25 – 67 Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business account Analysed #2396571 Valid Yelp Access Control Low 2025-01-28 – 60 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid HackerOne Access Control Medium 2023-11-22 – 57 Low-privileged user can enable or disable Lovable AI for new projects in workspace Analysed #3369843 Valid Lovable VDP Access Control Low 2025-11-07 – 56 Customer can cancel a individual booking in a batch, causing locking of partner. Analysed #3295503 Valid Bykea Input Validation and Logic Medium 2025-11-20 – 49 Guest users can create new test cases Analysed #1113289 Valid GitLab Access Control Medium 2021-08-30 $650 49 [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege Analysed #1091303 Valid Shopify Information Disclosure Medium 2021-04-08 – 46 Non privileged user is able to approve his own app himself leading to mass privilege escalations. Analysed #1168475 Valid Lark Technologies Access Control High 2021-11-20 – 45 Read-Only user can execute arbitraty shell commands on AirOS Analysed #139398 Valid Ubiquiti Inc. Command and Code Injection – 2016-08-05 – 44 Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution Analysed #3619409 Valid Monero Access Control High 2026-08-20 – 40 RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logs Analysed #3589551 Valid Rocket.Chat Access Control Medium 2026-04-23 – 40 html injection via invite members can be leads account takeover Analysed #1443567 Valid Mattermost Cross-site Scripting Low 2022-03-22 – 38 Read-only users can restore old versions Analysed #1356508 Valid Nextcloud Access Control Medium 2024-06-14 $500 38 Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT Analysed #909863 Valid Shopify Insecure Direct Object Reference Medium 2021-02-07 – 38 Low Privileged user can add or remove cash to/from sales register Analysed #905543 Valid Shopify Access Control Low 2021-06-16 – 37 Apache Airflow Sql injection by authenticated user Analysed #3078856 Valid Internet Bug Bounty SQL Injection Low 2025-05-27 $505 35 files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet Analysed #3770482 Valid Nextcloud Access Control Medium 2026-09-18 – 31 Read-only team members can read all properties of webhooks Analysed #818848 Valid HackerOne Access Control Low 2020-04-29 – 30 Guest Users can create issues for Sentry errors and track their status Analysed #1117768 Valid GitLab Access Control Low 2021-09-24 $610 29 Non-admin users can reset app allowlist to the default Analysed #2250398 Valid Nextcloud Input Validation and Logic Medium 2024-01-18 – 28 Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card number Analysed #858662 Valid Starbucks Insecure Direct Object Reference Low 2020-05-19 – 28 None permission staff member can identify installed application and products attached to it Analysed #848625 Valid Shopify Information Disclosure Low 2020-04-21 $500 26 Low Privileged Staff Member Can Export Billing Charges Analysed #1010835 Valid Shopify Access Control Medium 2020-11-26 $1,900 24 [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account Analysed #245872 Valid GSA Bounty Insecure Direct Object Reference Medium 2017-09-05 – 23 pam-ussh may be tricked into using another logged in user's ssh-agent Analysed #204802 Valid Uber Authentication Medium 2017-03-20 – 23 Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist Analysed #2251074 Valid Nextcloud Injection and Smuggling Medium 2024-01-18 – 22 Read-Only user can execute arbitraty shell commands on AirOS Analysed #128750 Valid Ubiquiti Inc. Command and Code Injection – 2016-08-05 – 22 Normal User is able to EXPORT Feature Usage Statistics Analysed #1470076 Valid Lark Technologies Access Control Medium 2022-03-04 – 21 Reporters can upload design to issues using the "Move to" feature Analysed #1112297 Valid GitLab Access Control Medium 2021-10-18 $600 21 Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpoint Analysed #810320 Valid Helium Access Control Medium 2020-06-29 – 21 Staff Member can Get POS Access Without User Interaction Analysed #1018094 Valid Shopify No weakness recorded Medium 2020-11-19 – 19 Read-Only user can delete users Analysed #888729 Valid Helium Insecure Direct Object Reference High 2020-07-10 – 19 Any authenticated user can download full list of users, including email Analysed #228399 Valid Discourse Information Disclosure Medium 2017-06-17 $256 19 Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed. Analysed #156520 Valid Algolia Authentication – 2016-11-27 $400 19 Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server Analysed #3769676 Valid MariaDB Memory Corruption Medium 2026-09-03 – 18 Read-Only user can execute arbitraty shell commands on AirOS Analysed #119317 Valid Ubiquiti Inc. Command and Code Injection – 2016-08-05 – 18 Viewer is able to leak the previous versions of the file Analysed #1080700 Valid Lark Technologies Access Control Medium 2022-10-24 – 17 MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service Analysed #3867358 Valid MariaDB Denial of Service Medium 2026-10-07 – 16 DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767) Analysed #3852135 Valid Rocket.Chat SQL Injection High 2026-08-20 – 16 Invited team member can disclosure slack channels Analysed #509574 Valid HackerOne Information Disclosure Low 2019-04-05 $500 16 Guests can continue to receive video streams from call after being removed from a conversation Analysed #1706248 Valid Nextcloud Information Disclosure Medium 2022-12-31 – 15 Non-admin users can trigger writes to memcached by entering a malicious server as a share URL Analysed #592864 Valid Nextcloud Injection and Smuggling Medium 2020-07-09 $100 15