Confidential data of users and limited metadata of programs and reports accessible via GraphQL Analysed #489146 Valid Information Disclosure Critical 2019-02-03 – 1,033 The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present Analysed #3000510 Valid Information Disclosure Critical 2025-04-01 – 625 Customer private program can disclose email any users through invited via username Analysed #807448 Valid Information Disclosure High 2020-05-15 $7,500 589 An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Analysed #2032716 Valid Information Disclosure High 2023-07-04 $12,500 429 Partial disclosure of report activity through new "Export as .zip" feature Analysed #182358 Valid Information Disclosure High 2016-11-29 $10,000 355 Information Disclosure in /skills call Analysed #188719 Valid Information Disclosure Medium 2017-01-05 $10,000 287 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure High 2016-11-30 $12,500 269 Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information Analysed #2937622 Valid Information Disclosure Medium 2025-05-31 – 226 Google Docs link in JS files allows editing & reading survey information Analysed #2180521 Valid Information Disclosure Medium 2023-11-04 – 217 Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status Analysed #654198 Valid Information Disclosure Low 2019-09-29 $500 213 An invite-only's program submission state is accessible to users no longer part of the program Analysed #800109 Valid Information Disclosure Low 2020-04-21 $500 194 Unauthorized access to metadata of undisclosed reports that were retested Analysed #871749 Valid Information Disclosure Medium 2020-06-05 – 189 Disclosure of `payment_transactions` for programs via GraphQL query Analysed #707433 Valid Information Disclosure Medium 2019-12-01 – 178 404-response contains debug-information with all headers Analysed #792998 Valid Information Disclosure Low 2020-05-16 – 173 Total Paid Bounty Paid can be disclose Analysed #674757 Valid Information Disclosure Low 2020-02-28 $500 168 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure Medium 2019-04-24 $3,000 147 Team object in GraphQL disclosed private_comment Analysed #978143 Valid Information Disclosure Medium 2020-09-10 $2,500 146 Unauthorized user can obtain `report_sources` attribute through Team GraphQL object Analysed #770209 Valid Information Disclosure Medium 2020-02-10 $2,500 142 Disclose any user's private email through API Analysed #196655 Valid Information Disclosure Medium 2017-02-24 – 140 Private program disclosure via `vpn_suspended` GraphQL query Analysed #715192 Valid Information Disclosure None 2019-10-21 $2,500 138 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure Medium 2019-11-08 – 127 Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████ Analysed #1285115 Valid Information Disclosure Medium 2021-11-08 – 118 Internal Gitlab Ticket Disclosure via External Slack Channels Analysed #1273292 Valid Information Disclosure High 2021-08-04 – 118 Emails of invited collaborators are disclosed in full in payload for report participants Analysed #269230 Valid Information Disclosure Low 2019-04-09 – 112 GraphQL field on Team node can be used to determine if External Program runs invite-only program Analysed #877642 Valid Information Disclosure Medium 2020-07-25 $2,500 107 Creation of bounties through Customer API leads to private email disclosure Analysed #2382120 Valid Information Disclosure Critical 2024-03-26 – 101 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report Analysed #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 Team object in GraphQL disclosed total number of whitelisted hackers Analysed #342978 Valid Information Disclosure Medium 2018-05-12 $2,500 93 Reading redacted data via hackbot's answers Analysed #247628 Valid Information Disclosure Medium 2017-07-27 $1,500 93 Some limited confidential information can still be accessed after a user exits a private program Analysed #2278865 Valid Information Disclosure Medium 2024-01-19 $50 86 "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statistics Analysed #696266 Valid Information Disclosure Low 2020-02-21 $500 86 Draft report exposure via slack alerting system for programs Analysed #2069593 Valid Information Disclosure Medium 2023-10-06 – 83 Possible PII Disclosure via Advanced Vetting Process - ██████ Analysed #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 Private information exposed through GraphQL filters Analysed #645299 Valid Information Disclosure Medium 2019-07-23 – 81 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" Analysed #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 inviting collaborator using email disclose the hackerone account related to the user Analysed #2045722 Valid Information Disclosure Medium 2024-09-19 – 80 latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users Analysed #724944 Valid Information Disclosure Low 2019-11-10 – 79 HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity Analysed #1826141 Valid Information Disclosure Low 2023-02-10 $500 78 Any organization's assets pending review can be downloaded Analysed #1787644 Valid Information Disclosure High 2022-11-29 – 76 Usernames still visible on report export pdf despite "I want to redact all usernames" is selected Analysed #2054222 Valid Information Disclosure Low 2023-08-08 $500 75 Team object in GraphQL discloses team group names and permissions Analysed #343464 Valid Information Disclosure Medium 2018-05-04 $2,500 75 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs Analysed #215625 Valid Information Disclosure Medium 2017-05-23 $2,000 75 Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted Analysed #958374 Valid Information Disclosure Low 2020-08-24 $500 74 Validation message in Bounty award endpoint can be used to determine program balances Analysed #293299 Valid Information Disclosure Medium 2017-11-29 – 73 Being able to disclose IBB bounty table of any public program Analysed #2322082 Valid Information Disclosure Medium 2024-03-17 – 72 Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS. Analysed #929361 Valid Information Disclosure Low 2020-10-02 – 71 The request tells the number of private programs, the new system of authorization /invite/token Analysed #310946 Valid Information Disclosure Medium 2018-02-14 $2,000 71 Inline banner on Report page discloses whether organization runs a private program Analysed #452973 Valid Information Disclosure Low 2018-12-11 $500 67 Private draft report exposure in a program a user is added as a viewer to Analysed #2552205 Valid Information Disclosure Medium 2024-09-17 $2,500 66 Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering Analysed #1132606 Valid Information Disclosure Medium 2021-08-24 – 66