Email address of any user can be queried on Report Invitation GraphQL type when username is known Analysed #792927 Valid Access Control High 2020-02-20 – 671 Team member with Program permission only can escalate to Admin permission Analysed #605720 Valid Access Control Medium 2019-06-26 – 268 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form Analysed #418767 Valid Access Control Medium 2018-10-31 $10,000 208 Banned user still has access to their deleted account via HackerOne's API using their API key Analysed #1577940 Valid Access Control Medium 2025-07-14 – 150 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid Access Control Low 2024-06-06 – 149 Subdomain takeover at info.hacker.one Analysed #202767 Valid Access Control Low 2017-03-27 – 134 Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse Analysed #3378540 Valid Access Control Low 2026-03-18 – 126 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 Banned user still able to invited to reports as a collabrator and reset the password Analysed #1959219 Valid Access Control Medium 2023-07-06 – 107 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 Bypass report submit restriction/ban using the API key Analysed #2081930 Valid Access Control Medium 2023-10-29 – 91 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control Medium 2018-12-05 $2,500 90 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86 Any one can view collaborater email address via path /reports/<id>/participants Analysed #1918362 Valid Access Control Low 2023-06-01 – 78 Subdomain takeover #2 at info.hacker.one Analysed #209004 Valid Access Control Low 2017-04-28 – 78 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member Analysed #2632876 Valid Access Control Low 2024-12-24 – 77 Race condition leads to duplicate payouts Analysed #220445 Valid Access Control Low 2017-05-23 – 73 Non Org Admin/Group Manager can create groups in an organization Analysed #2372018 Valid Access Control High 2024-07-23 – 68 Private program disclosure of `██████████` through notifications Analysed #1179241 Valid Access Control Low 2021-06-09 $500 66 "package_name" can be set as desired when submitting a Pentest Opportunity form Analysed #2431495 Valid Access Control Medium 2024-06-19 – 63 Subdomain takeover #3 at info.hacker.one Analysed #217358 Valid Access Control Low 2017-06-21 – 58 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid Access Control Medium 2023-11-22 – 57 Staff and Triage can modify the initial post of a report, including of already disclosed reports Analysed #2096271 Valid Access Control Medium 2023-08-28 – 50 Subdomain takeover #4 at info.hacker.one Analysed #220002 Valid Access Control Low 2017-06-21 – 50 View HackerOne challenge scope before challenge begins Analysed #565736 Valid Access Control Low 2019-07-11 – 48 Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled Analysed #634679 Valid Access Control Medium 2019-07-05 – 47 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot Analysed #357485 Valid Access Control Low 2018-06-27 $500 45 Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based" Analysed #427502 Valid Access Control Medium 2018-11-07 $2,500 43 Private program disclosure through notifications Analysed #1234746 Valid Access Control Low 2021-08-05 $500 39 Read-only team members can read all properties of webhooks Analysed #818848 Valid Access Control Low 2020-04-29 – 30 HackerOne Pentesters can access any structured scope object through GraphQL node interface Analysed #781150 Valid Access Control High 2020-03-11 – 30 A user can request a report to be retested even though the program has not been verified by HackerOne Analysed #448078 Valid Access Control Low 2018-12-27 – 27 Disabled account can still use GraphQL endpoint Analysed #608656 Valid Access Control Low 2020-03-12 – 24 Hacker can request mediation for published reports Analysed #412988 Valid Access Control Low 2018-11-27 $500 23 Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report Analysed #442843 Valid Access Control Low 2018-12-04 $500 21 Inadequate access controls in "Vote" functionality??? Analysed #137503 Valid Access Control – 2016-05-12 – 15 Missing rate limit on critical user actions e.g. reset password, change email, disable account. Analysed #157750 Valid Access Control – 2019-04-11 – 14