Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryAnalysed#2122671 | Valid | Insecure Direct Object Reference | High | 2023-08-29 | – | 395 |
| IDOR allows user to access report details via reference.json endpointAnalysed#3862641 | Valid | Insecure Direct Object Reference | Critical | 2026-10-01 | $15,000 | 372 |
| Insecure Direct Object Reference (IDOR) - Delete CampaignsAnalysed#1969141 | Valid | Insecure Direct Object Reference | High | 2023-05-03 | – | 346 |
| Attachment disclosure via summary reportAnalysed#2442008 | Valid | Insecure Direct Object Reference | Critical | 2024-04-29 | – | 340 |
| IDOR vulnerability in unreleased HackerOne Copilot featureAnalysed#2218334 | Valid | Insecure Direct Object Reference | Medium | 2023-10-25 | – | 210 |
| IDOR Vulnerability at AddTagToAssets operation nameAnalysed#2633771 | Valid | Insecure Direct Object Reference | Medium | 2025-06-08 | – | 178 |
| Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpointAnalysed#536853 | Valid | Insecure Direct Object Reference | Low | 2019-04-23 | – | 161 |
| IDOR on HackerOne Feedback ReviewAnalysed#262661 | Valid | Insecure Direct Object Reference | Low | 2017-09-02 | – | 79 |
| Reporter, external users, collaborators can mark sent swag awarded to reporter as unsentAnalysed#717729 | Valid | Insecure Direct Object Reference | Medium | 2019-10-25 | – | 76 |
| IDOR in Report CSV export discloses the IDs of Custom Field Attributes of ProgramsAnalysed#510759 | Valid | Insecure Direct Object Reference | Low | 2019-09-06 | – | 67 |
| Any user with access to program can resume and suspend HackerOne GatewayAnalysed#717716 | Valid | Insecure Direct Object Reference | Medium | 2019-10-21 | – | 65 |
| IDOR in Bugs overview enables attacker to determine the date range a hackathon was activeAnalysed#663431 | Valid | Insecure Direct Object Reference | Low | 2019-12-13 | – | 33 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.