Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
[PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permission#2209433	Valid	Access Control	–	2024-01-03	–	31
[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissions#2184950	Valid	Access Control	–	2024-01-03	–	42
Managing Pages#1690427	Valid	Access Control	–	2022-12-22	–	54
GHES Management console EoP (editor to site admin)#2197796	Valid	Access Control	–	2024-01-08	–	56
Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository Transfer#2190827	Valid	Access Control	–	2024-03-15	–	57
PATs without the required scope can leak issues#3522254	Valid	Access Control	Medium	2026-03-19	–	59
GitHub user to server tokens can create issues in any public repository#3641229	Valid	Access Control	Medium	2026-07-22	–	62
View private repository NWO of deploy key via internal LFS API#2469713	Valid	Access Control	Medium	2024-07-23	–	70
GitHub scoped user to server tokens can escape their installation#3638909	Valid	Access Control	High	2026-07-29	–	80
GitHub Apps can access suspended installations via scoped user-to-server tokens#2484635	Valid	Access Control	Medium	2024-07-31	–	90
Github app Privilege Escalation to Administrator/Owner of the Organization#1732595	Valid	Access Control	–	2023-01-13	–	98
Authentication bypass on gist.github.com through SSH CertificatesAnalysed#1901040	Valid	Access Control	–	2023-04-20	$10,000	182
SAML Signature verification bypass allows logging into any user (with specific conditions)Analysed#2579939	Valid	Access Control	Critical	2024-10-10	–	196
Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiAnalysed#1711938	Valid	Access Control	–	2023-01-26	–	198

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.