Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Race condition in performing retest allows duplicated paymentsAnalysed#429026	Valid	Race Conditions	–	2018-12-27	–	240
Team member with Program permission only can escalate to Admin permissionAnalysed#605720	Valid	Access Control	–	2019-06-26	–	268
Internal attachments can be exported via "Export as .zip" featureAnalysed#186230	Valid	Information Disclosure	–	2016-11-30	$12,500	269
Information Disclosure in /skills callAnalysed#188719	Valid	Information Disclosure	–	2017-01-05	$10,000	287
An attacker can archive and unarchive any structured scope object on HackerOneAnalysed#1501611	Valid	No weakness recorded	–	2022-04-18	–	318
Getting New Invitations without Leaving ProgramsAnalysed#999789	Valid	Input Validation and Logic	–	2020-10-15	–	322
Attachment disclosure via summary reportAnalysed#2442008	Valid	Insecure Direct Object Reference	–	2024-04-29	–	340
Insecure Direct Object Reference (IDOR) - Delete CampaignsAnalysed#1969141	Valid	Insecure Direct Object Reference	–	2023-05-03	–	346
Partial disclosure of report activity through new "Export as .zip" featureAnalysed#182358	Valid	Information Disclosure	–	2016-11-29	$10,000	355
Hackerone is not properly deleting user idAnalysed#1133118	Valid	Input Validation and Logic	–	2021-06-11	–	356
[CVE-2022-44268] Arbitrary Remote Leak via ImageMagickAnalysed#1858574	Valid	File and Path Handling	–	2023-03-16	–	371
IDOR allows user to access report details via reference.json endpointAnalysed#3862641	Valid	Insecure Direct Object Reference	Critical	2026-10-01	$15,000	372
IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryAnalysed#2122671	Valid	Insecure Direct Object Reference	–	2023-08-29	–	395
An attacker can can view any hacker email via /SaveCollaboratorsMutation operation nameAnalysed#2032716	Valid	Information Disclosure	–	2023-07-04	$12,500	429
profile-picture name parameter with large value lead to DoS for other users and programs on the platformAnalysed#764434	Valid	Denial of Service	–	2020-03-25	–	475
Customer private program can disclose email any users through invited via usernameAnalysed#807448	Valid	Information Disclosure	–	2020-05-15	$7,500	589
Email address of any user can be queried on Report Invitation GraphQL type when username is knownAnalysed#792927	Valid	Access Control	–	2020-02-20	–	671

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.