Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Changing paymentProfileUuid when booking a trip allows free ridesAnalysed#162809	Valid	Cross-Site Request Forgery	–	2016-09-15	–	73
[uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.Analysed#201326	Valid	Cross-Site Request Forgery	Critical	2023-03-23	$2,000	50
Site-wide CSRF on eats.uber.comAnalysed#161529	Valid	Cross-Site Request Forgery	High	2018-12-19	–	30
Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilitiesAnalysed#323899	Valid	Cross-Site Request Forgery	Medium	2021-02-25	$500	29
Chained vulnerabilities create DOS attack against users on desafio5estrelas.com#624645	Valid	Cross-Site Request Forgery	Low	2021-03-30	$1,000	17
Lack of CSRF protection on uberps.com makes every form vulnerable to CSRF#343120	Valid	Cross-Site Request Forgery	Medium	2021-03-15	$500	15
CSRF on eng.uber.com may lead to server-side compromise#125594	Valid	Cross-Site Request Forgery	–	2016-04-26	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.