Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Privilege Escalation with Session Hijacking Having a Non-privileged Valid User#242407	Valid	No weakness recorded	Critical	2017-12-04	–	6
Reflected File Download in community.ubnt.com/restapi/#107960	Valid	No weakness recorded	–	2017-05-27	–	11
UBNT Amplification DDOS AttackAnalysed#221625	Valid	No weakness recorded	Critical	2019-02-06	–	14
CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protectionAnalysed#240098	Valid	No weakness recorded	Critical	2017-11-24	–	14
Privilege Escalation: From operator to ubnt (and root) with non-interactive Session HijackingAnalysed#241044	Valid	No weakness recorded	Critical	2017-11-24	–	16
[account-global.ubnt.com] CRLF InjectionAnalysed#145128	Valid	No weakness recorded	Low	2017-03-31	–	17
IDOR Causing Deletion of any accountAnalysed#156537	Valid	No weakness recorded	–	2016-11-29	–	30
Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.comAnalysed#301406	Valid	No weakness recorded	High	2018-03-07	–	47

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.