Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Cross-site Scripting (XSS) - Stored in RDoc wiki pagesAnalysed#662287 | Valid | Misconfiguration and Insecure Design | – | 2019-12-16 | $3,500 | 282 |
| Ability To Delete User(s) Account Without User InteractionAnalysed#928255 | Valid | Misconfiguration and Insecure Design | – | 2021-03-17 | – | 221 |
| Subdomain takeover in Gitlab pages#2523654 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-09 | – | 79 |
| Remove obsolete domain from handbook subdomain#2599840 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-01 | – | 72 |
| Bypass Email Verification using Salesforce -- Reproducible in gitlab.com#617896 | Valid | Misconfiguration and Insecure Design | – | 2019-12-13 | – | 55 |
| Change project visibility to a restricted option#1086781 | Valid | Misconfiguration and Insecure Design | – | 2021-12-30 | $1,370 | 51 |
| Insecure 2FA/authentication implementation creates a brute force vulnerability#149598 | Valid | Misconfiguration and Insecure Design | – | 2016-10-28 | – | 33 |
| A profile page of a user can be denied from loading by appending .html to the username#475098 | Valid | Misconfiguration and Insecure Design | – | 2021-08-30 | $200 | 26 |
| Gitlab is vulnerable to impersonation attacks due to broken links#265696 | Valid | Misconfiguration and Insecure Design | – | 2017-09-06 | – | 21 |
| Impersonation attack via Broken Link in Resellers Page#266908 | Valid | Misconfiguration and Insecure Design | – | 2017-09-08 | – | 12 |
| Gitlab.com is vulnerable to reverse tabnabbing. (#2)#212629 | Valid | Misconfiguration and Insecure Design | – | 2017-05-09 | – | 8 |
| Dependecy Confusion via Lookup Request Forwarding to PyPi.org#1681275 | Informative | Misconfiguration and Insecure Design | – | 2022-11-21 | – | 6 |
| Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3)#213114 | Valid | Misconfiguration and Insecure Design | – | 2017-05-09 | – | 5 |
| Email notification about login email changed is not received when using verified linked email address#801973 | N/A | Misconfiguration and Insecure Design | – | 2020-03-25 | – | 3 |
| Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution#224198 | Informative | Misconfiguration and Insecure Design | – | 2017-06-28 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.