User with Read-Only permissions can edit the SwagAwarded Activities on Bug Reports #118731 Valid Access Control – 2016-04-01 – 2 User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions #119221 Valid Access Control – 2016-04-01 $500 3 Team member invitations to sandboxed teams are not invalidated consistently (v2) #48422 Valid Access Control – 2015-02-27 – 6 Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants #107336 Valid Access Control – 2016-01-27 – 7 Change Any username and profile link in hackerone #25281 Valid Access Control – 2014-09-25 $100 9 Requesting Mediation possible on reports that are too old for mediation #159512 Valid Access Control – 2016-08-17 – 13 Missing rate limit on critical user actions e.g. reset password, change email, disable account. #157750 Valid Access Control – 2019-04-11 – 14 Inadequate access controls in "Vote" functionality??? #137503 Valid Access Control – 2016-05-12 – 15 Ability to monitor reports' submission in real time #159890 N/A Access Control – 2016-08-17 – 16 Graphql: Sorting the reports by jira_status field resulted to different value #955286 Valid Access Control Low 2020-08-27 – 20 Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report #442843 Valid Access Control Low 2018-12-04 $500 21 Hacker can request mediation for published reports #412988 Valid Access Control Low 2018-11-27 $500 23 Disabled account can still use GraphQL endpoint #608656 Valid Access Control Low 2020-03-12 – 24 A user can request a report to be retested even though the program has not been verified by HackerOne #448078 Valid Access Control Low 2018-12-27 – 27 HackerOne Pentesters can access any structured scope object through GraphQL node interface #781150 Valid Access Control High 2020-03-11 – 30 Read-only team members can read all properties of webhooks #818848 Valid Access Control Low 2020-04-29 – 30 Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program #2569993 Informative Access Control Low 2024-07-11 – 32 Bypassing Two-Factor Authentication via Account Deactivation and Password Reset #2543342 Duplicate Access Control None 2024-07-11 – 33 Reset the 2FA of the user which can lead to Account Takeover #2492631 Duplicate Access Control Medium 2024-07-11 – 37 Private program disclosure through notifications #1234746 Valid Access Control Low 2021-08-05 $500 39 User with privilege to maintain External Programs can update certain churned HackerOne programs #411930 Valid Access Control Low 2018-10-25 $500 41 Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based" #427502 Valid Access Control Medium 2018-11-07 $2,500 43 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot #357485 Valid Access Control Low 2018-06-27 $500 45 Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled Analysed #634679 Valid Access Control Medium 2019-07-05 – 47 View HackerOne challenge scope before challenge begins Analysed #565736 Valid Access Control Low 2019-07-11 – 48 Bypass comment restriction #2679108 Informative Access Control Medium 2024-09-19 – 48 Subdomain takeover #4 at info.hacker.one Analysed #220002 Valid Access Control Low 2017-06-21 – 50 Staff and Triage can modify the initial post of a report, including of already disclosed reports Analysed #2096271 Valid Access Control Medium 2023-08-28 – 50 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid Access Control Medium 2023-11-22 – 57 Subdomain takeover #3 at info.hacker.one Analysed #217358 Valid Access Control Low 2017-06-21 – 58 Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects Analysed #781175 Valid Access Control Medium 2020-03-20 – 59 "package_name" can be set as desired when submitting a Pentest Opportunity form Analysed #2431495 Valid Access Control Medium 2024-06-19 – 63 Private program disclosure of `██████████` through notifications Analysed #1179241 Valid Access Control Low 2021-06-09 $500 66 Non Org Admin/Group Manager can create groups in an organization Analysed #2372018 Valid Access Control High 2024-07-23 – 68 Race condition leads to duplicate payouts Analysed #220445 Valid Access Control Low 2017-05-23 – 73 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member Analysed #2632876 Valid Access Control Low 2024-12-24 – 77 Subdomain takeover #2 at info.hacker.one Analysed #209004 Valid Access Control Low 2017-04-28 – 78 Any one can view collaborater email address via path /reports/<id>/participants Analysed #1918362 Valid Access Control Low 2023-06-01 – 78 Program admins could add verified domains to an organization Analysed #2323303 Valid Access Control Low 2024-03-07 – 83 Scope information is leaked when visiting policy scopes tab of any External Program Analysed #1868473 Valid Access Control Medium 2023-03-10 – 86 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control Medium 2018-12-05 $2,500 90 Bypass report submit restriction/ban using the API key Analysed #2081930 Valid Access Control Medium 2023-10-29 – 91 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 Banned user still able to invited to reports as a collabrator and reset the password Analysed #1959219 Valid Access Control Medium 2023-07-06 – 107 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse Analysed #3378540 Valid Access Control Low 2026-03-18 – 126