Email address of any user can be queried on Report Invitation GraphQL type when username is known Analysed #792927 Valid Access Control High 2020-02-20 – 671 Team member with Program permission only can escalate to Admin permission Analysed #605720 Valid Access Control Medium 2019-06-26 – 268 View Titles of Private Reports with pending email invitation Analysed #2312029 Valid Access Control High 2024-01-16 – 257 Account takeover of existing HackerOne accounts through SCIM provisioning Analysed #3178999 Valid Access Control High 2025-07-17 – 232 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form Analysed #418767 Valid Access Control Medium 2018-10-31 $10,000 208 Banned user still has access to their deleted account via HackerOne's API using their API key Analysed #1577940 Valid Access Control Medium 2025-07-14 – 150 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid Access Control Low 2024-06-06 – 149 Takeover of hackerone.engineering via Github Analysed #2085260 Valid Access Control Medium 2023-07-31 – 135 Subdomain takeover at info.hacker.one Analysed #202767 Valid Access Control Low 2017-03-27 – 134 Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse Analysed #3378540 Valid Access Control Low 2026-03-18 – 126 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 Banned user still able to invited to reports as a collabrator and reset the password Analysed #1959219 Valid Access Control Medium 2023-07-06 – 107 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 Bypass report submit restriction/ban using the API key Analysed #2081930 Valid Access Control Medium 2023-10-29 – 91 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control Medium 2018-12-05 $2,500 90 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86 Scope information is leaked when visiting policy scopes tab of any External Program Analysed #1868473 Valid Access Control Medium 2023-03-10 – 86 Program admins could add verified domains to an organization Analysed #2323303 Valid Access Control Low 2024-03-07 – 83 Any one can view collaborater email address via path /reports/<id>/participants Analysed #1918362 Valid Access Control Low 2023-06-01 – 78 Subdomain takeover #2 at info.hacker.one Analysed #209004 Valid Access Control Low 2017-04-28 – 78 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member Analysed #2632876 Valid Access Control Low 2024-12-24 – 77 Race condition leads to duplicate payouts Analysed #220445 Valid Access Control Low 2017-05-23 – 73 Non Org Admin/Group Manager can create groups in an organization Analysed #2372018 Valid Access Control High 2024-07-23 – 68 Private program disclosure of `██████████` through notifications Analysed #1179241 Valid Access Control Low 2021-06-09 $500 66 "package_name" can be set as desired when submitting a Pentest Opportunity form Analysed #2431495 Valid Access Control Medium 2024-06-19 – 63 Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects Analysed #781175 Valid Access Control Medium 2020-03-20 – 59 Subdomain takeover #3 at info.hacker.one Analysed #217358 Valid Access Control Low 2017-06-21 – 58 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid Access Control Medium 2023-11-22 – 57 Staff and Triage can modify the initial post of a report, including of already disclosed reports Analysed #2096271 Valid Access Control Medium 2023-08-28 – 50 Subdomain takeover #4 at info.hacker.one Analysed #220002 Valid Access Control Low 2017-06-21 – 50 Bypass comment restriction #2679108 Informative Access Control Medium 2024-09-19 – 48 View HackerOne challenge scope before challenge begins Analysed #565736 Valid Access Control Low 2019-07-11 – 48 Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled Analysed #634679 Valid Access Control Medium 2019-07-05 – 47 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot Analysed #357485 Valid Access Control Low 2018-06-27 $500 45 Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based" Analysed #427502 Valid Access Control Medium 2018-11-07 $2,500 43 User with privilege to maintain External Programs can update certain churned HackerOne programs Analysed #411930 Valid Access Control Low 2018-10-25 $500 41 Private program disclosure through notifications Analysed #1234746 Valid Access Control Low 2021-08-05 $500 39 Reset the 2FA of the user which can lead to Account Takeover #2492631 Duplicate Access Control Medium 2024-07-11 – 37 Bypassing Two-Factor Authentication via Account Deactivation and Password Reset #2543342 Duplicate Access Control None 2024-07-11 – 33 Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program #2569993 Informative Access Control Low 2024-07-11 – 32 Read-only team members can read all properties of webhooks #818848 Valid Access Control Low 2020-04-29 – 30 HackerOne Pentesters can access any structured scope object through GraphQL node interface #781150 Valid Access Control High 2020-03-11 – 30 A user can request a report to be retested even though the program has not been verified by HackerOne #448078 Valid Access Control Low 2018-12-27 – 27 Disabled account can still use GraphQL endpoint #608656 Valid Access Control Low 2020-03-12 – 24 Hacker can request mediation for published reports #412988 Valid Access Control Low 2018-11-27 $500 23 Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report #442843 Valid Access Control Low 2018-12-04 $500 21 Graphql: Sorting the reports by jira_status field resulted to different value #955286 Valid Access Control Low 2020-08-27 – 20