Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SSRF when configuring Website Backup on Acronis Cloud#1072873 | No longer public | Server-Side Request Forgery | – | – | $500 | 30 |
| Render content from untrusted sources via web_preview endpoint on Acronis Cloud#1848118 | No longer public | Injection and Smuggling | – | – | $200 | 46 |
| DOM Based Cookie Bomb in *.acronis.com via x-clickref GET Parameter#1898305 | No longer public | Denial of Service | – | – | $200 | 52 |
| PUT Based CSRF via Client Side Path Traversal + Cookie Bomb on Acronis Cloud#1860380 | No longer public | File and Path Handling | – | – | $600 | 76 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.