Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Privilege escalation to allow non activated users to login and use uber partner ios app#126260	N/A	Access Control	–	2016-06-13	–	1
Compromising Atlassian Confluence (team.uberinternal.com) via WordPress (newsroom.uber.com)#136531	Valid	Access Control	–	2016-06-06	–	4
Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII#1010787	Valid	Access Control	High	2021-05-14	–	13
Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com#149679	Valid	Access Control	–	2016-07-25	–	21
Improper Access Control on Onelogin in multi-layered architectureAnalysed#326080	Valid	Access Control	–	2018-08-08	$500	29
Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employeesAnalysed#1063022	Valid	Access Control	Medium	2021-05-14	–	29
4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl )Analysed#1116545	Valid	Access Control	Medium	2021-04-29	$500	29
Subdomain takeover on mta1a1.spmail.uber.comAnalysed#707748	Valid	Access Control	Medium	2020-04-06	–	30
Subdomain takeover on rider.uber.com due to non-existent distribution on CloudfrontAnalysed#175070	Valid	Access Control	–	2016-12-12	–	69
Subdomain takeover at signup.uber.comAnalysed#197489	Valid	Access Control	High	2019-01-25	–	79
Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Analysed#530441	Valid	Access Control	Low	2021-03-06	$4,500	210

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.