Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Confidential data of users and limited metadata of programs and reports accessible via GraphQLAnalysed#489146	Valid	Information Disclosure	Critical	2019-02-03	–	1,033
Team object in GraphQL discloses team group names and permissionsAnalysed#343464	Valid	Information Disclosure	Medium	2018-05-04	$2,500	75
Pentester can obtain information about other pentesters who applied for the same test, but weren't acceptedAnalysed#958374	Valid	Information Disclosure	Low	2020-08-24	$500	74
Being able to disclose IBB bounty table of any public programAnalysed#2322082	Valid	Information Disclosure	Medium	2024-03-17	–	72
Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS.Analysed#929361	Valid	Information Disclosure	Low	2020-10-02	–	71
The request tells the number of private programs, the new system of authorization /invite/tokenAnalysed#310946	Valid	Information Disclosure	Medium	2018-02-14	$2,000	71
TeamProfile exposes partially sensitive information through GraphQLAnalysed#389600	Valid	Information Disclosure	Low	2018-08-08	–	60
Private program name disclosure in the invitation mail for another programAnalysed#2228413	Valid	Information Disclosure	Low	2023-12-08	–	58
New Search Feature: Search for non-public words in limited disclosure reportsAnalysed#2213251	Valid	Information Disclosure	Medium	2023-10-25	–	55
Team object in GraphQL that have a published external program may expose existence of a private programAnalysed#347937	Valid	Information Disclosure	None	2018-07-04	–	39
Report invitation links not restricted to any existing userAnalysed#214839	Valid	Information Disclosure	Low	2017-05-23	$500	39
Internal usage of AdBlockPlus may expose PoC URLs to unknown third-partiesAnalysed#395518	Valid	Information Disclosure	Low	2018-08-17	–	32
View Any Program's Team Members through GET https://hackerone.com/invitations/Analysed#283014	Valid	Information Disclosure	Medium	2017-11-01	$1,000	32
A small set of users were assigned someone else's payout preferenceAnalysed#498845	Valid	Information Disclosure	Low	2019-02-20	–	30
Ability to enumerate private programs using SAMLAnalysed#167828	Valid	Information Disclosure	–	2016-09-14	–	24
program_analytics_benchmarks query shows information not visible in publicAnalysed#826176	Valid	Information Disclosure	Low	2020-03-27	–	22

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.