Reports Programs Subdomains Program: GitLab Status Severity Weakness: Access Control Year Bounty paid5 Access stated Access needed: A user account Technique Clear filters 13 of 15,219 reports Disclosed bug bounty reports Report Status Weakness Severity Disclosed Bounty Votes Exfiltrate and mutate repository and project data through injected templated service Analysed #446585 Valid Access Control Critical 2019-03-05 $11,000 762 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control Critical 2019-11-27 $12,000 457 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control High 2019-07-03 – 351 Privilege escalation from any user (including external) to gitlab admin when admin impersonates you Analysed #493324 Valid Access Control Critical 2020-08-26 – 256 Group search with Elastic search enable leaks unrelated data Analysed #708820 Valid Access Control High 2019-12-14 – 100 RepositoryPipeline allows importing of local git repos Analysed #1685822 Valid Access Control Medium 2022-11-04 $22,300 89 Privilege escalation of "external user" (with maintainer privilege) to internal access through project token Analysed #1193062 Valid Access Control Medium 2021-10-11 – 66 Ability to access all user authentication tokens, leads to RCE Analysed #158330 Valid Access Control Critical 2016-11-03 – 61 Improper access control for users with expired password, giving the user full access through API and Git Analysed #1285226 Valid Access Control Medium 2022-01-27 – 49 Guest users can create new test cases Analysed #1113289 Valid Access Control Medium 2021-08-30 $650 49 A deactivated user can access data through GraphQL Analysed #1192460 Valid Access Control Medium 2021-08-30 – 47 Milestones leaked via search API Analysed #460815 Valid Access Control Low 2019-07-19 – 43 Kroki Arbitrary File Read/Write Analysed #1098793 Valid Access Control High 2021-05-21 $5,600 41
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.