Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
ID4me feature of OpenID connect app available even when disabledAnalysed#2376929	Valid	Access Control	Medium	2024-05-30	–	66
Profile of disabled user stays accessibleAnalysed#1675014	Valid	Access Control	Low	2022-11-26	$100	27
Error in Booking an appointment reveals the full path of the websiteAnalysed#1841408	Valid	Access Control	Low	2023-06-18	–	24
"Secure View" aka "Hide Download" can be bypassed easilyAnalysed#788257	Valid	Access Control	High	2020-04-10	–	22
Missing rate limiting on password reset functionality allows to send lot of emailsAnalysed#1691195	Valid	Access Control	Low	2023-03-05	$100	17
xmlrpc.php is enabled - NextcloudAnalysed#458696	Valid	Access Control	Medium	2020-03-01	–	17
File drop public link can also be converted to federated shareAnalysed#1167929	Valid	Access Control	Low	2021-06-10	$500	15
Virtual Data Room / Hide download on collabora is easy to bypassAnalysed#1194606	Valid	Access Control	High	2021-08-07	$150	14
Combination of content provider allows private data disclosureAnalysed#534541	Valid	Access Control	Low	2019-07-26	$100	14

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.