Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessInformation Disclosure
- Any class
- Cross-site Scripting57
- Cross-Site Request Forgery6
- Open Redirect5
- Server-Side Request Forgery18
- SQL Injection1
- Command and Code Injection18
- Injection and Smuggling4
- File and Path Handling5
- Memory Corruption1
- Denial of Service14
- Input Validation and Logic7
- Misconfiguration and Insecure Design15
- Information Disclosure32
- Authentication9
- Access Control52
- Insecure Direct Object Reference12
- No weakness recorded1
Access (analysis)Any
TechniqueAny
32 of 15,219 reports · $26,300 in bounties · 227 analysed so far
- #850447ValidAnalysedgitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readGitLab · Information Disclosure · 2020 · needs: a user account · Missing authorisation check, Information disclosure, Path traversal$10,000410votes
- #509924ValidAnalysedJSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsGitLab · Information Disclosure · 2019 · needs: a user account · IDOR / object reference, Missing authorisation check, Information disclosure, Leaked secret or key$12,000366votes
- #348443ValidSnippet JS template allows attacker to read a user's private snippetsGitLab · Information Disclosure · 2019$300165votes
- #460545Validinformation disclosure of secret_key_base via encoding charctersGitLab · Information Disclosure · 2019$3,500146votes
- #178152ValidRead files on application server, leads to RCEGitLab · Information Disclosure · 2016–114votes
- #979787ValidAble to view hackerone reports attachmentsGitLab · Information Disclosure · 2022–103votes
- #495497ValidKnow whether private project name exists or not within a group using link commentsGitLab · Information Disclosure · 2019–58votes
- #446238ValidEXIF metadata not stripped from JPG group logosGitLab · Information Disclosure · 2020$50055votes
- #2104591ValidMaintainer can leak sentry token by changing the configured URL (fix bypass)GitLab · Information Disclosure · 2024 · Medium–32votes
- #972355ValidAble to leak private email of any user given his/her username via graphqlGitLab · Information Disclosure · 2021–29votes
- #853355ValidUnauthorized access to private project security dashboardGitLab · Information Disclosure · 2020–24votes
- #477222ValidLast build status and coverage leaked to unauthorized usersGitLab · Information Disclosure · 2019–24votes
- #407763ValidUnauthorized users may be able to view almost all informations related to Private projects.GitLab · Information Disclosure · 2018–24votes
- #214028ValidRace condition in GitLab import, giving access to other people their imports due to filename collisionGitLab · Information Disclosure · 2017–22votes
- #633001ValidPrivate System Note Disclosure using GraphQLGitLab · Information Disclosure · 2019–17votes
- #605608Valid[information disclosure] Validate existence of a private project.GitLab · Information Disclosure · 2021–14votes
- #985124DuplicateGraphQL Query leads to sensitive information disclosureGitLab · Information Disclosure · 2021–12votes
- #135937ValidSSRF when importing a project from a git repo by URLGitLab · Information Disclosure · 2018–12votes
- #195058ValidUsers can download old project exports due to unclaimed namespaceGitLab · Information Disclosure · 2017–10votes
- #162147ValidBoards leak private label names and desciptionsGitLab · Information Disclosure · 2016–10votes
- #128051ValidAttacker can extract list of private project's project membersGitLab · Information Disclosure · 2016–10votes
- #962462ValidUnauthorized user is able to access schedule pipeline variables and valuesGitLab · Information Disclosure · 2020–9votes
- #1643962ValidPath paths and file disclosure vulnerabilities at influxdb.quality.gitlab.netGitLab · Information Disclosure · 2022–8votes
- #1089914InformativeResponsible Disclosure of Privacy Leakage IssueGitLab · Information Disclosure · 2021–7votes
- #880863ValidTodos are not redacted when membership changes - Access to (confidential) issues and merge requestsGitLab · Information Disclosure · 2020–7votes
- #134305ValidPrivate snippets in public / internal projects leaked though GitLab APIGitLab · Information Disclosure · 2016–7votes
- #132777ValidLabels created in private projects are leakedGitLab · Information Disclosure · 2016–7votes
- #133717ValidGFM renderer leaks external issue tracker URL of private projectGitLab · Information Disclosure · 2017–6votes
- #636560ValidProject Milestones Disclosed Via Groups When the Victim disabled milestones access in project settingsGitLab · Information Disclosure · 2019–5votes
- #491319N/AGuests Will Disclose the Private Project Full Activity Via Project Activity FeedsGitLab · Information Disclosure · 2019–5votes
- #134300ValidConfidential issues leaked in public projects when attached to milestoneGitLab · Information Disclosure · 2016–5votes
- #874401InformativeUse of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilitiesGitLab · Information Disclosure · 2021–2votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.