Customer private program can disclose email any users through invited via username Analysed #807448 Valid Information Disclosure High 2020-05-15 $7,500 589 An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Analysed #2032716 Valid Information Disclosure High 2023-07-04 $12,500 429 Partial disclosure of report activity through new "Export as .zip" feature Analysed #182358 Valid Information Disclosure High 2016-11-29 $10,000 355 Information Disclosure in /skills call Analysed #188719 Valid Information Disclosure Medium 2017-01-05 $10,000 287 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure High 2016-11-30 $12,500 269 Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status Analysed #654198 Valid Information Disclosure Low 2019-09-29 $500 213 An invite-only's program submission state is accessible to users no longer part of the program Analysed #800109 Valid Information Disclosure Low 2020-04-21 $500 194 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure Medium 2019-04-24 $3,000 147 Disclose any user's private email through API Analysed #196655 Valid Information Disclosure Medium 2017-02-24 – 140 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure Medium 2019-11-08 – 127 Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████ Analysed #1285115 Valid Information Disclosure Medium 2021-11-08 – 118 Internal Gitlab Ticket Disclosure via External Slack Channels Analysed #1273292 Valid Information Disclosure High 2021-08-04 – 118 Emails of invited collaborators are disclosed in full in payload for report participants Analysed #269230 Valid Information Disclosure Low 2019-04-09 – 112 Creation of bounties through Customer API leads to private email disclosure Analysed #2382120 Valid Information Disclosure Critical 2024-03-26 – 101 Reading redacted data via hackbot's answers Analysed #247628 Valid Information Disclosure Medium 2017-07-27 $1,500 93 Some limited confidential information can still be accessed after a user exits a private program Analysed #2278865 Valid Information Disclosure Medium 2024-01-19 $50 86 Draft report exposure via slack alerting system for programs Analysed #2069593 Valid Information Disclosure Medium 2023-10-06 – 83 Possible PII Disclosure via Advanced Vetting Process - ██████ Analysed #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 Private information exposed through GraphQL filters Analysed #645299 Valid Information Disclosure Medium 2019-07-23 – 81 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" Analysed #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 inviting collaborator using email disclose the hackerone account related to the user Analysed #2045722 Valid Information Disclosure Medium 2024-09-19 – 80 latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users Analysed #724944 Valid Information Disclosure Low 2019-11-10 – 79 Any organization's assets pending review can be downloaded Analysed #1787644 Valid Information Disclosure High 2022-11-29 – 76 Usernames still visible on report export pdf despite "I want to redact all usernames" is selected Analysed #2054222 Valid Information Disclosure Low 2023-08-08 $500 75 Validation message in Bounty award endpoint can be used to determine program balances Analysed #293299 Valid Information Disclosure Medium 2017-11-29 – 73 Inline banner on Report page discloses whether organization runs a private program Analysed #452973 Valid Information Disclosure Low 2018-12-11 $500 67 Private draft report exposure in a program a user is added as a viewer to Analysed #2552205 Valid Information Disclosure Medium 2024-09-17 $2,500 66 Hackers can find out the ID of private programs Analysed #1129649 Valid Information Disclosure Low 2021-08-24 – 64 Report Private Links Leaks to Google Analytics via Query String Param Analysed #269479 Valid Information Disclosure Medium 2017-10-25 – 59 Private program policy page still accessible after user left the program Analysed #386997 Valid Information Disclosure Medium 2018-08-12 $2,500 57 Hacker email disclosed on submission at hackerone hactivity Analysed #2215434 Valid Information Disclosure Low 2023-10-24 $100 53 Extra program metrics disclosed via /PROGRAM_NAME json response Analysed #327088 Valid Information Disclosure Medium 2018-03-28 – 51 Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information Analysed #1242680 Valid Information Disclosure Low 2021-06-24 – 46 ImageMagick GIF coder vulnerability leading to memory disclosure Analysed #302885 Valid Information Disclosure Low 2018-02-07 $500 44 Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature Analysed #397031 Valid Information Disclosure Low 2018-11-07 – 42 Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs Analysed #1219011 Valid Information Disclosure Low 2021-06-30 $500 41 Hackers can reveal the names of private programs that have an external link and Enterprise Product Edition Analysed #1130235 Valid Information Disclosure Low 2021-08-24 – 32 Attacker can claim credentials for private program that has a published external program Analysed #449680 Valid Information Disclosure Medium 2018-11-29 – 32 Invitation tokens leak to Google Analytics Analysed #237262 Valid Information Disclosure Low 2017-07-16 – 32 Disclosure of h1 challenges name through the calendar Analysed #488643 Valid Information Disclosure Low 2019-01-30 – 29 Private invitation links/tokens leak to third-party analytics site Analysed #1491127 Valid Information Disclosure Low 2022-04-05 $500 28 User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program Analysed #350964 Valid Information Disclosure None 2018-06-27 – 24 People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed Analysed #353310 Valid Information Disclosure Low 2018-06-25 $500 23 Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query Analysed #1824342 Valid Information Disclosure Medium 2023-02-22 – 21