Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
IDOR on partners.uber.com allows for a driver to override administrator documents#194594	Valid	Insecure Direct Object Reference	Medium	2018-12-19	–	23
IDOR in activateFuelCard id allows bulk lookup of driver uuids#254151	Valid	Insecure Direct Object Reference	Low	2019-01-25	–	28
Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment accountAnalysed#1145428	Valid	Insecure Direct Object Reference	High	2021-08-12	$5,750	58
Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PIIAnalysed#1148697	Valid	Insecure Direct Object Reference	High	2022-04-07	–	64
IDOR leads to See analytics of Loyalty Program in any restaurant.Analysed#1137819	Valid	Insecure Direct Object Reference	Medium	2021-05-28	–	112
IDOR leads to leak analytics of any restaurantAnalysed#1116387	Valid	Insecure Direct Object Reference	Medium	2021-04-29	–	123

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.