Asset Inventory Internal Descriptions are leaked in CSV export Analysed #2011431 Valid Input Validation and Logic Medium 2023-07-12 – 76 Near to Infinite loop when changing Group's name that has API token as Team Member Analysed #880187 Valid No weakness recorded Medium 2020-07-23 $2,500 77 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member Analysed #2632876 Valid Access Control Low 2024-12-24 – 77 Subdomain takeover #2 at info.hacker.one Analysed #209004 Valid Access Control Low 2017-04-28 – 78 HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity Analysed #1826141 Valid Information Disclosure Low 2023-02-10 $500 78 Any one can view collaborater email address via path /reports/<id>/participants Analysed #1918362 Valid Access Control Low 2023-06-01 – 78 IDOR on HackerOne Feedback Review Analysed #262661 Valid Insecure Direct Object Reference Low 2017-09-02 – 79 latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users Analysed #724944 Valid Information Disclosure Low 2019-11-10 – 79 inviting collaborator using email disclose the hackerone account related to the user Analysed #2045722 Valid Information Disclosure Medium 2024-09-19 – 80 Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter Analysed #2106708 Valid Cross-site Scripting Low 2023-08-22 – 80 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" Analysed #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 Private information exposed through GraphQL filters Analysed #645299 Valid Information Disclosure Medium 2019-07-23 – 81 [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse #2241266 Informative Misconfiguration and Insecure Design Medium 2024-05-30 – 81 Improper UUID validation results in bypass of #419896 Analysed #423073 Valid Input Validation and Logic High 2018-10-25 – 82 Possible PII Disclosure via Advanced Vetting Process - ██████ Analysed #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile Analysed #2553026 Valid Misconfiguration and Insecure Design Low 2025-03-13 – 82 Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent] Analysed #1043372 Valid Denial of Service Low 2021-02-02 – 83 Draft report exposure via slack alerting system for programs Analysed #2069593 Valid Information Disclosure Medium 2023-10-06 – 83 Program admins could add verified domains to an organization Analysed #2323303 Valid Access Control Low 2024-03-07 – 83 Login CSRF vulnerability on hackerone.com Analysed #834366 Valid Cross-Site Request Forgery Low 2020-06-12 $500 84 Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com) Analysed #995995 Valid Cross-site Scripting None 2020-11-09 – 84 HTML Injection in email via Name field Analysed #1581499 Valid Cross-site Scripting Low 2022-09-18 $500 84 Triager/Team members can edit hacker's report and hacker is not even notified Analysed #2061367 Valid No weakness recorded Medium 2023-08-31 $2,500 84 "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statistics Analysed #696266 Valid Information Disclosure Low 2020-02-21 $500 86 Scope information is leaked when visiting policy scopes tab of any External Program Analysed #1868473 Valid Access Control Medium 2023-03-10 – 86 Some limited confidential information can still be accessed after a user exits a private program Analysed #2278865 Valid Information Disclosure Medium 2024-01-19 $50 86 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86 Unauthenticated user can upload an attachment to the last updated report draft Analysed #419896 Valid Memory Corruption High 2018-10-09 – 87 SQL Injection in CVE Discovery Search Analysed #1893800 Valid SQL Injection High 2023-03-06 – 87 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control Medium 2018-12-05 $2,500 90 Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users Analysed #1034346 Valid Insecure Direct Object Reference High 2020-11-17 – 91 Bypass report submit restriction/ban using the API key Analysed #2081930 Valid Access Control Medium 2023-10-29 – 91 Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer #2263294 Informative Input Validation and Logic None 2024-05-10 – 91 Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale Analysed #2476149 Valid No weakness recorded Low 2024-05-09 – 91 `exportReportPdf` mutation shows internal Activity Analysed #3577216 Valid No weakness recorded High 2026-07-29 – 92 Reading redacted data via hackbot's answers Analysed #247628 Valid Information Disclosure Medium 2017-07-27 $1,500 93 Team object in GraphQL disclosed total number of whitelisted hackers Analysed #342978 Valid Information Disclosure Medium 2018-05-12 $2,500 93 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 Race Condition in Flag Submission Analysed #454949 Valid Race Conditions Low 2019-07-22 – 94 Password not checked when disabling 2FA on HackerOne Analysed #587910 Valid Misconfiguration and Insecure Design Low 2019-06-07 – 95 Subdomain takeover of resources.hackerone.com Analysed #863551 Valid No weakness recorded Low 2020-05-15 $500 95 Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted request Analysed #861170 Valid Denial of Service Low 2020-05-25 – 97 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report Analysed #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 How the Arch Angel stole Live Events Analysed #2285198 Valid No weakness recorded None 2023-12-15 – 98 Creation of bounties through Customer API leads to private email disclosure Analysed #2382120 Valid Information Disclosure Critical 2024-03-26 – 101 Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid} Analysed #1558010 Valid Cross-site Scripting High 2022-05-25 – 102 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature Analysed #334205 Valid Input Validation and Logic Medium 2018-04-18 $2,500 103 [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content" Analysed #669438 Valid No weakness recorded Low 2019-09-09 $500 104 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) Analysed #499030 Valid Cross-site Scripting Low 2019-05-04 – 106