Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiAnalysed#1711938	Valid	Access Control	High	2023-01-26	–	198
GitHub Apps can access suspended installations via scoped user-to-server tokensAnalysed#2484635	Valid	Access Control	Medium	2024-07-31	–	90
GitHub scoped user to server tokens can escape their installationAnalysed#3638909	Valid	Access Control	High	2026-07-29	–	80
PATs without the required scope can leak issuesAnalysed#3522254	Valid	Access Control	Medium	2026-03-19	–	59
Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository TransferAnalysed#2190827	Valid	Access Control	Medium	2024-03-15	–	57
GHES Management console EoP (editor to site admin)Analysed#2197796	Valid	Access Control	High	2024-01-08	–	56
Managing PagesAnalysed#1690427	Valid	Access Control	Medium	2022-12-22	–	54
[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissionsAnalysed#2184950	Valid	Access Control	Medium	2024-01-03	–	42
[PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permissionAnalysed#2209433	Valid	Access Control	Medium	2024-01-03	–	31

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.