How the Bug stole hacking Analysed #762510 Valid Insecure Direct Object Reference None 2019-12-20 – 471 IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query Analysed #2122671 Valid Insecure Direct Object Reference High 2023-08-29 – 395 IDOR allows user to access report details via reference.json endpoint Analysed #3862641 Valid Insecure Direct Object Reference Critical 2026-10-01 $15,000 372 Insecure Direct Object Reference (IDOR) - Delete Campaigns Analysed #1969141 Valid Insecure Direct Object Reference High 2023-05-03 – 346 Attachment disclosure via summary report Analysed #2442008 Valid Insecure Direct Object Reference Critical 2024-04-29 – 340 Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint Analysed #2487889 Valid Insecure Direct Object Reference Critical 2024-05-23 – 266 IDOR vulnerability in unreleased HackerOne Copilot feature Analysed #2218334 Valid Insecure Direct Object Reference Medium 2023-10-25 – 210 IDOR Vulnerability at AddTagToAssets operation name Analysed #2633771 Valid Insecure Direct Object Reference Medium 2025-06-08 – 178 Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint Analysed #536853 Valid Insecure Direct Object Reference Low 2019-04-23 – 161 [IDOR] Improper Access Control on Embedded Submission Form Analysed #2483666 Valid Insecure Direct Object Reference Low 2024-06-19 $2,500 110 Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users Analysed #1034346 Valid Insecure Direct Object Reference High 2020-11-17 – 91 IDOR on HackerOne Feedback Review Analysed #262661 Valid Insecure Direct Object Reference Low 2017-09-02 – 79 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid Insecure Direct Object Reference Medium 2019-10-25 – 76 IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs Analysed #510759 Valid Insecure Direct Object Reference Low 2019-09-06 – 67 Any user with access to program can resume and suspend HackerOne Gateway Analysed #717716 Valid Insecure Direct Object Reference Medium 2019-10-21 – 65 Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details #447930 Valid Insecure Direct Object Reference High 2019-01-11 – 54 IDOR in Bugs overview enables attacker to determine the date range a hackathon was active #663431 Valid Insecure Direct Object Reference Low 2019-12-13 – 33 IDOR on Program Visibilty (Revealed / Concealed) against other team members #291721 Duplicate Insecure Direct Object Reference Medium 2017-11-23 – 33 Moving a report to a different program doesn't reassign the Custom Field Values #511779 Valid Insecure Direct Object Reference Low 2019-04-25 – 15