Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Stored XSS in Slackbot Direct Messages#4561	Valid	Cross-site Scripting	–	2014-05-04	–	8
Open Redirect login account#16718	Valid	Open Redirect	–	2014-08-25	$100	8
"a stored xss issue in share post menu"#148848	Valid	Cross-site Scripting	–	2017-06-25	$500	8
Data exports stored on S3 can be scraped easily#2746	Valid	Authentication	–	2014-12-09	–	9
Stored XSS Found#9774	Valid	Cross-site Scripting	–	2014-06-01	–	9
a stored xss issue in https://files.slack.com#149011	Valid	Cross-site Scripting	–	2017-06-25	$500	9
Possibility to freeze/crash the host system of all Slack Desktop users easily#392728	Valid	Misconfiguration and Insecure Design	Low	2020-11-10	–	9
Slack OAuth2 "redirect_uri" Bypass#2575	Valid	Authentication	–	2014-05-29	–	10
Authentication bypass leads to sensitive data exposure (token+secret)#129918	Valid	Authentication	–	2016-10-19	$2,000	10
User can start call in a channel of an unpaid account#147369	Valid	Access Control	–	2016-09-15	$100	10
Creating Post on a restricted channel#151459	Valid	Access Control	–	2016-09-29	–	10
Relative Path Vulnerability Results in Arbitrary Command Execution/Privilege Escalation#784714	Valid	Command and Code Injection	Medium	2020-04-01	$750	10
Open redirect vulnerability#2731	Informative	Open Redirect	–	2014-04-06	–	11
CSV export/import functionality allows administrators to modify member and message content of a workspace#1661310	Informative	Access Control	None	2022-09-28	$250	11
Open Redirect on slack.com#140447	Valid	Cross-site Scripting	–	2016-10-02	$500	12
dom xss in https://www.slackatwork.com#196624	Valid	Cross-site Scripting	Low	2017-03-02	–	13
Shared-channel BETA persists integration after unshare#291822	Valid	Input Validation and Logic	Medium	2018-04-25	$750	13
HTML Injection inside Slack promotional emails#321029	Valid	No weakness recorded	Low	2018-07-30	$100	13
Cross-site leak allows attacker to de-anonymize members of his team from another origin#1068153	Valid	Access Control	Low	2021-11-11	$250	13
Bypass of the SSRF protection (Slack commands, Phabricator integration)#61312	Valid	No weakness recorded	–	2016-09-14	$100	14
Code Injection in Slack's Windows Desktop Client leads to Privilege Escalation#162955	Valid	Command and Code Injection	–	2017-07-14	–	14
Information Disclosure on stun.screenhero.com#175061	Valid	Information Disclosure	Medium	2016-11-30	$700	14
Bypass to postMessage origin validation via FTP#210654	Valid	Cross-site Scripting	High	2017-04-21	–	15
Invitation reminder emails contain insecure links#327674	Valid	Cryptography	Low	2019-06-29	$350	15
Facebook Takeover using Slack using 302 from files.slack.com with access_token#6017	Valid	Open Redirect	–	2015-01-11	–	17
Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authentication#238260	Valid	Authentication	Low	2020-11-10	$500	18
Stored XSS in files.slack.com#827606	Valid	Cross-site Scripting	Medium	2021-12-02	–	19
CSRF in github integrationAnalysed#174328	Valid	Cross-Site Request Forgery	Medium	2016-11-18	$500	22
[Screenhero] Subdomain takeoverAnalysed#142096	Valid	Misconfiguration and Insecure Design	–	2017-01-21	–	23
Misuse of groups feature allows workspace members to join private channels without being invitedAnalysed#1248852	Valid	Access Control	High	2021-10-21	–	23
Source code leakage through GIT web access at host '52.91.137.42'Analysed#148068	Valid	Authentication	–	2016-08-15	–	26
HTTP parameter pollution from outdated Greenhouse.io JS dependencyAnalysed#335339	Valid	Injection and Smuggling	Medium	2018-07-19	–	26
Rate-limit bypassAnalysed#165727	Valid	Authentication	–	2016-11-28	$500	27
Subdomain takeover on podcasts.slack-core.comAnalysed#195350	Valid	Cross-site Scripting	Low	2017-01-04	$100	27
Email html InjectionAnalysed#1461194	Valid	Command and Code Injection	Low	2022-05-19	$250	28
Stored XSS(Cross Site Scripting) In Slack App NameAnalysed#159460	Valid	Cross-site Scripting	–	2016-11-22	$1,000	29
Race Condition in account surveyAnalysed#165570	Valid	Misconfiguration and Insecure Design	–	2017-11-12	–	29
DoS on the Direct MessagesAnalysed#746003	Valid	Denial of Service	Medium	2020-11-11	$500	29
Snooping into messages via email serviceAnalysed#163938	Valid	Authentication	–	2016-09-14	–	30
Access of Android protected components via embedded intentAnalysed#200427	Valid	Access Control	Critical	2017-07-17	–	31
URL filter bypass in Enterprise GridAnalysed#500348	Valid	Input Validation and Logic	Low	2020-02-14	$100	32
Bypass two-factor authenticationAnalysed#121696	Valid	Authentication	–	2017-11-18	–	36
CSS Injection to disable app & potential message exfilAnalysed#679969	Valid	Input Validation and Logic	Medium	2019-11-09	–	37
Private application files can be uploaded to Slack via malicious uploaderAnalysed#375083	Valid	Information Disclosure	Medium	2021-08-04	$500	38
Workspace configuration metadata disclosureAnalysed#864489	Valid	Information Disclosure	High	2022-04-01	–	39
Slack-Corp Heroku application disclosing limited info about company membersAnalysed#966814	Valid	Information Disclosure	Low	2020-12-09	–	39
Information leakage and default open portAnalysed#305518	Valid	No weakness recorded	Low	2019-06-22	–	41
Store XSSAnalysed#187410	Valid	Cross-site Scripting	High	2017-01-01	–	44
The POODLE attack (SSLv3 supported) at status.slack.comAnalysed#375097	Valid	Cryptography	Medium	2018-11-28	–	44
Linux Desktop application slack executable does not use pie / no ASLRAnalysed#415272	Valid	Misconfiguration and Insecure Design	Low	2019-11-17	$100	47

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.