Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Last pipeline status for MR leaked#582349	Valid	Authentication	Low	2019-10-01	–	10
Inadequate cache control in gitter allows to view private chat room#493791	Duplicate	Authentication	None	2019-03-08	–	13
Bypassing password authentication of users that have 2FA enabledAnalysed#128085	Valid	Authentication	–	2016-04-18	–	27
Remote hacker can download all the files of master branch in public projects where everything is members only.Analysed#1043480	Valid	Authentication	Medium	2021-02-15	–	31
Exposure of a valid Gitlab-Workhorse JWT leading to various bad thingsAnalysed#1040786	Valid	Authentication	High	2022-07-05	$10,000	36
Access to GitLab's Slack by abusing issue creation from e-mailAnalysed#218230	Valid	Authentication	Critical	2017-09-21	–	54
Login email verification bypass via `/oauth/token`.#2676025	Informative	Authentication	None	2024-09-03	–	66
Mint Oauth2 access token for targeted userAnalysed#1148364	Valid	Authentication	High	2025-07-23	$5,580	140
Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAnalysed#922456	Valid	Authentication	High	2020-10-01	$3,000	257

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.