Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAccess Control
- Any class
- Cross-site Scripting1
- Cross-Site Request Forgery1
- Open Redirect1
- Command and Code Injection7
- Injection and Smuggling4
- Deserialization and Object Injection1
- Denial of Service1
- Input Validation and Logic1
- Misconfiguration and Insecure Design3
- Cryptography1
- Information Disclosure3
- Authentication1
- Access Control14
- Insecure Direct Object Reference6
- No weakness recorded2
14 of 15,219 reports · $10,000 in bounties · 161 analysed so far
- #1711938ValidGithub Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiGitHub · Access Control · 2023–198votes
- #2579939ValidSAML Signature verification bypass allows logging into any user (with specific conditions)GitHub · Access Control · 2024 · Critical–196votes
- #1901040ValidAuthentication bypass on gist.github.com through SSH CertificatesGitHub · Access Control · 2023$10,000182votes
- #1732595ValidGithub app Privilege Escalation to Administrator/Owner of the OrganizationGitHub · Access Control · 2023–98votes
- #2484635ValidGitHub Apps can access suspended installations via scoped user-to-server tokensGitHub · Access Control · 2024 · Medium–90votes
- #3638909ValidGitHub scoped user to server tokens can escape their installationGitHub · Access Control · 2026 · High–80votes
- #2469713ValidView private repository NWO of deploy key via internal LFS APIGitHub · Access Control · 2024 · Medium–70votes
- #3641229ValidGitHub user to server tokens can create issues in any public repositoryGitHub · Access Control · 2026 · Medium–62votes
- #3522254ValidPATs without the required scope can leak issuesGitHub · Access Control · 2026 · Medium–59votes
- #2190827ValidBypassing Collaborator Restrictions: Retaining Admin Access Post-Repository TransferGitHub · Access Control · 2024–57votes
- #2197796ValidGHES Management console EoP (editor to site admin)GitHub · Access Control · 2024–56votes
- #1690427ValidManaging PagesGitHub · Access Control · 2022–54votes
- #2184950Valid[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissionsGitHub · Access Control · 2024–42votes
- #2209433Valid[PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permissionGitHub · Access Control · 2024–31votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.