Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Access to all files of remote user through shared fileAnalysed#258084 | Valid | Information Disclosure | Medium | 2020-03-01 | – | 154 |
| Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scopeAnalysed#3617729 | Valid | Information Disclosure | Medium | 2026-09-04 | $250 | 101 |
| Events information leaked with shared calendars on recurrence exceptionsAnalysed#2479325 | Valid | Information Disclosure | Low | 2024-06-14 | $100 | 45 |
| Email Enumeration via Password-Protected Share Identity VerificationAnalysed#3507273 | Valid | Information Disclosure | Low | 2026-09-05 | $100 | 35 |
| Database error shown to the user when using a long guest name in richdocumentsAnalysed#1067824 | Valid | Information Disclosure | – | 2021-02-07 | – | 29 |
| Cards in Deck are readable by any userAnalysed#1331728 | Valid | Information Disclosure | Medium | 2023-03-26 | – | 25 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.