Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF - Changing the full name / adding a secondary email identity of an account via a GET request#223367 | Valid | Cross-Site Request Forgery | Medium | 2017-06-02 | – | 3 |
| CSRF bypass ( Delate Source Translation From dictionaries ) in demo.weblate.org#230863 | Valid | Cross-Site Request Forgery | Medium | 2017-06-02 | – | 4 |
| CSRF : Lock and Unlock Translation#223345 | Valid | Cross-Site Request Forgery | Medium | 2017-05-17 | – | 5 |
| Csrf in watch-unwatch projects#229405 | Valid | Cross-Site Request Forgery | Low | 2017-08-17 | – | 5 |
| Send Empty CSRF leads to log out user on [https://hosted.weblate.org/accounts/profile]#1003468 | Valid | Cross-Site Request Forgery | Low | 2020-10-12 | – | 5 |
| Logout CSRF#223329 | Valid | Cross-Site Request Forgery | Low | 2017-05-17 | – | 7 |
| CSRF : Reset API#223333 | Valid | Cross-Site Request Forgery | Low | 2017-05-17 | – | 7 |
| CSRF to Connect third party Account#225100 | Valid | Cross-Site Request Forgery | Medium | 2017-05-02 | – | 7 |
| Activation tokens are not expiring#223339 | Valid | Cross-Site Request Forgery | Medium | 2017-05-17 | – | 9 |
| Account Takeover using Third party Auth CSRF#225653 | Valid | Cross-Site Request Forgery | High | 2017-05-17 | – | 11 |
| Login CSRF : Login Authentication Flaw#229528 | Valid | Cross-Site Request Forgery | Medium | 2017-06-02 | – | 11 |
| CSRF with logout actionAnalysed#1971589 | Valid | Cross-Site Request Forgery | – | 2023-06-16 | – | 29 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.