Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Ad Account TakeoverAnalysed#1791720	Valid	Access Control	Critical	2023-07-20	–	30
Deny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id}Analysed#2081744	Valid	Access Control	Medium	2023-10-19	–	34
Delete any LinkedIn comment on learning API of other usersAnalysed#1801527	Valid	Access Control	Medium	2023-05-12	–	41
Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]Analysed#1572591	Valid	Access Control	Medium	2022-08-26	–	48
Blocking a company page admin prevents him from delete paid media admin or edit his rolesAnalysed#2339192	Valid	Access Control	Medium	2026-03-05	–	55
Users can access exams in course without having to subscribe to PREMIUMAnalysed#1892888	Valid	Access Control	Medium	2024-01-10	–	64
Employee-only Area BypassAnalysed#2299571	Valid	Access Control	Medium	2024-02-19	–	77
Improper Access Control - Access to "Active Hiring" (Premium feature) filter resultsAnalysed#3235855	Valid	Access Control	Medium	2026-02-03	–	100
Previous commentor on post can still comment even after comment permission is changed to disabledAnalysed#3151001	Valid	Access Control	Low	2026-02-03	–	112
Can delete other user's post and company page postAnalysed#337755	Valid	Access Control	–	2023-04-11	–	156

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.