Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Initial mirror user can be assigned by other user even if the mirror was removed#819821 | Valid | Access Control | Medium | 2020-08-26 | $3,000 | 4 |
| Revoked User can still view the Merge Request created by him via API#962604 | Valid | Access Control | Medium | 2021-03-15 | $1,500 | 9 |
| Installing Gitlab runner with Docker-In-Docker allows root access#1417211 | Valid | Access Control | – | 2022-02-10 | $100 | 9 |
| Blocked user Git access through CI/CD token#497047 | Valid | Access Control | Medium | 2019-12-13 | $1,500 | 11 |
| XSS by clicking Jira's link#1194254 | Valid | Cross-site Scripting | Medium | 2022-06-08 | $1,130 | 12 |
| Guest users can change the confidentiality attribute on those issues that have been assigned to them#762271 | Valid | Access Control | Low | 2020-11-09 | $100 | 13 |
| ReDoS in syntax highlighting due to Rouge#1283484 | Valid | Denial of Service | Medium | 2021-11-15 | $600 | 13 |
| GitHub import allows user to create child group under existing namespace#301137 | Valid | Access Control | High | 2018-05-24 | $750 | 14 |
| Gitlab Pages token theft using service workers#1439552 | Valid | Access Control | Medium | 2022-06-08 | $1,680 | 14 |
| Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ...#960244 | Valid | Memory Corruption | High | 2020-11-02 | $5,000 | 16 |
| Insufficient Type Check on GraphQL leading to Maintainer delete repository#858671 | Valid | Access Control | High | 2020-11-02 | $4,000 | 18 |
| DOS via move_issue#1543584 | Valid | Denial of Service | Medium | 2022-11-04 | $2,300 | 19 |
| Instant open redirect on Live preview WEB Ide openingAnalysed#437142 | Valid | Open Redirect | Low | 2020-11-04 | $1,000 | 20 |
| Reporters can upload design to issues using the "Move to" featureAnalysed#1112297 | Valid | Access Control | Medium | 2021-10-18 | $600 | 21 |
| Attacker can create malicious child epics linked to a victim's epic in an unrelated groupAnalysed#1892200 | Valid | Insecure Direct Object Reference | Medium | 2023-06-02 | $1,160 | 22 |
| SafeParamsHelper::safe_params is not so safeAnalysed#946728 | Valid | Cross-site Scripting | High | 2020-11-02 | $4,000 | 24 |
| Domain Takeover - gl-canary.freetls.fastly.netAnalysed#716677 | Valid | Access Control | Low | 2023-05-30 | $200 | 25 |
| Stored XSS on PyPi simple API endpointAnalysed#856836 | Valid | Cross-site Scripting | Medium | 2020-09-09 | $3,000 | 25 |
| DOS via issue previewAnalysed#1543718 | Valid | Denial of Service | High | 2022-11-04 | $7,640 | 25 |
| Claiming package names in GitLab's automatic package referencer.Analysed#462503 | Valid | Input Validation and Logic | Low | 2019-04-05 | $1,000 | 26 |
| A profile page of a user can be denied from loading by appending .html to the usernameAnalysed#475098 | Valid | Misconfiguration and Insecure Design | Low | 2021-08-30 | $200 | 26 |
| Stored XSS in group issue listAnalysed#859333 | Valid | Cross-site Scripting | Medium | 2020-11-21 | $2,000 | 27 |
| Stored DOM XSS via Mermaid chartAnalysed#1103258 | Valid | Cross-site Scripting | High | 2021-07-12 | $3,000 | 27 |
| Drive-by arbitrary file deletion in the GDK via letter_opener_web gemAnalysed#1353103 | Valid | Cross-Site Request Forgery | Medium | 2021-11-12 | $750 | 27 |
| Stored XSS in repository file viewerAnalysed#1072868 | Valid | Cross-site Scripting | Medium | 2022-05-19 | $2,000 | 29 |
| Guest Users can create issues for Sentry errors and track their statusAnalysed#1117768 | Valid | Access Control | Low | 2021-09-24 | $610 | 29 |
| Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippetAnalysed#1751258 | Valid | Insecure Direct Object Reference | Medium | 2023-06-02 | $1,730 | 29 |
| GitLab's GitHub integration is vulnerable to SSRF vulnerabilityAnalysed#446593 | Valid | Server-Side Request Forgery | Medium | 2019-08-30 | $2,000 | 30 |
| Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hookAnalysed#299473 | Valid | Server-Side Request Forgery | High | 2018-04-27 | $750 | 36 |
| Injection of `http.<url>.*` git config settings leading to SSRFAnalysed#855276 | Valid | Server-Side Request Forgery | High | 2020-09-08 | $3,000 | 36 |
| Exposure of a valid Gitlab-Workhorse JWT leading to various bad thingsAnalysed#1040786 | Valid | Authentication | High | 2022-07-05 | $10,000 | 36 |
| Stored XSS on issue comments and other pages which contain notesAnalysed#1398305 | Valid | Cross-site Scripting | High | 2022-06-08 | $3,000 | 38 |
| Using GitLab to monitor and hijack domains in mass quantity.Analysed#312118 | Valid | Input Validation and Logic | High | 2018-02-21 | $750 | 39 |
| When you call your branch the same name as a git hash, it could be checked out by dependentsAnalysed#790634 | Valid | Injection and Smuggling | Medium | 2021-08-19 | $2,000 | 39 |
| SQL injection in MilestoneFinder order methodAnalysed#298176 | Valid | SQL Injection | Critical | 2018-04-27 | $2,000 | 41 |
| Kroki Arbitrary File Read/WriteAnalysed#1098793 | Valid | Access Control | High | 2021-05-21 | $5,600 | 41 |
| GitLab CI runner can read and poison cache of all other projectsAnalysed#301432 | Valid | File and Path Handling | Critical | 2018-04-27 | $2,000 | 43 |
| Stored XSS via Mermaid Prototype Pollution vulnerabilityAnalysed#1280002 | Valid | Cross-site Scripting | High | 2021-11-18 | $3,000 | 48 |
| View the Starred Projects in a Private ProfileAnalysed#703894 | Valid | Insecure Direct Object Reference | Low | 2021-02-02 | $500 | 49 |
| Guest users can create new test casesAnalysed#1113289 | Valid | Access Control | Medium | 2021-08-30 | $650 | 49 |
| Command injection by overwriting authorized_keys file through GitLab importAnalysed#298873 | Valid | Command and Code Injection | Critical | 2018-04-27 | $2,000 | 50 |
| Stored XSS in markdown when redacting referencesAnalysed#836649 | Valid | Cross-site Scripting | High | 2020-09-09 | $5,000 | 50 |
| Stored XSS on the job pageAnalysed#856554 | Valid | Cross-site Scripting | High | 2021-01-08 | $3,000 | 50 |
| RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installedAnalysed#1401444 | Valid | Command and Code Injection | – | 2022-04-12 | $3,000 | 50 |
| Change project visibility to a restricted optionAnalysed#1086781 | Valid | Misconfiguration and Insecure Design | Medium | 2021-12-30 | $1,370 | 51 |
| All functions that allow users to specify color code are vulnerable to ReDoSAnalysed#511381 | Valid | Denial of Service | Low | 2019-08-21 | $1,000 | 53 |
| Stored XSS in merge request pagesAnalysed#723307 | Valid | Cross-site Scripting | High | 2023-05-30 | $3,500 | 53 |
| EXIF metadata not stripped from JPG group logosAnalysed#446238 | Valid | Information Disclosure | Low | 2020-09-08 | $500 | 55 |
| Stored XSS via Mermaid Prototype Pollution vulnerabilityAnalysed#1106238 | Valid | Cross-site Scripting | High | 2021-07-12 | $3,000 | 58 |
| HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressAnalysed#1935628 | Valid | Injection and Smuggling | Low | 2024-10-08 | $1,060 | 61 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.