Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Steal private objects of other projects via project importAnalysed#743953	Valid	Insecure Direct Object Reference	–	2022-06-07	$20,000	254
Importing GitLab project archives can replace uploads of other users#534794	Valid	Insecure Direct Object Reference	–	2019-12-11	–	148
Private objects exposed through project import#767770	Valid	Insecure Direct Object Reference	–	2022-06-07	$20,000	133
IDOR Exposes All Machine Learning Models#2528293	Valid	Insecure Direct Object Reference	Medium	2024-10-01	$1,160	117
View the Starred Projects in a Private Profile#703894	Valid	Insecure Direct Object Reference	–	2021-02-02	$500	49
IDOR in "external status check" API leaks data about any status check on the instance#1372216	Valid	Insecure Direct Object Reference	–	2022-02-22	–	35
Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet#1751258	Valid	Insecure Direct Object Reference	–	2023-06-02	$1,730	29
Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR)#439729	Valid	Insecure Direct Object Reference	–	2019-09-19	–	27
Stealing data from customers.gitlab.com without user interaction#674195	Valid	Insecure Direct Object Reference	–	2020-08-26	–	25
Attacker can create malicious child epics linked to a victim's epic in an unrelated group#1892200	Valid	Insecure Direct Object Reference	–	2023-06-02	$1,160	22
[Subgroups] Unprivileged User Can Disclose Private Group Names#215384	Valid	Insecure Direct Object Reference	–	2017-03-30	–	11
Adding everyone to the repo due to the lack of rate limit#978768	N/A	Insecure Direct Object Reference	–	2020-09-14	–	8

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.