Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Changing paymentProfileUuid when booking a trip allows free rides#162809	Valid	Cross-Site Request Forgery	–	2016-09-15	–	73
[uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.#201326	Valid	Cross-Site Request Forgery	–	2023-03-23	$2,000	50
Attacker could setup reminder remotely using brute force#158393	N/A	Cross-Site Request Forgery	–	2016-09-19	–	36
Site-wide CSRF on eats.uber.com#161529	Valid	Cross-Site Request Forgery	–	2018-12-19	–	30
Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilities#323899	Valid	Cross-Site Request Forgery	–	2021-02-25	$500	29
Chained vulnerabilities create DOS attack against users on desafio5estrelas.com#624645	Valid	Cross-Site Request Forgery	–	2021-03-30	$1,000	17
Lack of CSRF protection on uberps.com makes every form vulnerable to CSRF#343120	Valid	Cross-Site Request Forgery	–	2021-03-15	$500	15
Newsroom.uber HTML form without CSRF protection#144147	Informative	Cross-Site Request Forgery	–	2016-07-07	–	3
CSRF on eng.uber.com may lead to server-side compromise#125594	Valid	Cross-Site Request Forgery	–	2016-04-26	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.