Privilege Escalation leads to trash other users comment without having admin rights. #1307943 Valid Access Control – 2021-12-01 – 9 SSL expired subdomain leads to API swap with main and flagged cookies. Unable to log device ids and certain session tokens. #1024880 Valid Authentication – 2020-12-03 – 15 Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source. #1050656 Valid No weakness recorded – 2020-12-17 – 17 Login session not expire #1294231 Valid Authentication – 2021-08-10 $100 18 com.basecamp.bc3 Webview Javascript Injection and JS bridge takeover #1343300 Valid Cross-site Scripting – 2022-09-23 – 21 Improper Authentication via previous backup code login #1485788 Valid Authentication – 2022-03-24 – 24 Unauthenticated request smuggling on launchpad.37signals.com #867577 Valid Injection and Smuggling – 2020-10-28 – 27 Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce #3981292 Valid Cross-site Scripting High 2026-10-28 – 27 HTTP request smuggling on Basecamp 2 allows web cache poisoning #919175 Valid Injection and Smuggling – 2020-10-28 – 28 Lack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCE #1019389 Valid No weakness recorded – 2021-04-22 $250 29 RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.com #1456063 Valid Deserialization and Object Injection – 2022-04-26 $100 30 Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com #2552879 Valid Deserialization and Object Injection Medium 2024-07-09 – 31 Information Disclosure of Garbage Collection Cycle #981796 Valid Information Disclosure – 2020-11-04 – 33 Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow #3972760 Valid Open Redirect Medium 2026-10-15 – 33 A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option #3999856 Valid Access Control High 2026-10-30 – 33 Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook #3979217 Valid Authentication High 2026-10-30 – 34 Arbitrary write in the application's data folder and arbitrary read of server's replies from 3rd party apps. #1710541 Valid File and Path Handling – 2023-06-07 – 38 Information Disclosure of Garbage Collection Cycle 'Again' #1026196 Valid Information Disclosure – 2020-12-16 $100 41 CSRF on launchpad.37signals.com OAuth2 authorization endpoint #850022 Valid Cross-Site Request Forgery – 2020-10-30 – 44 Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses #4035023 Valid Access Control High 2026-10-20 – 44 Error Page Content Spoofing or Text Injection #1245051 Valid Misconfiguration and Insecure Design – 2021-07-14 $100 45 Remote Code Execution in Basecamp Windows Electron App #1016966 Valid Command and Code Injection – 2020-11-19 – 48 Domain Takeover [3737signals.com] #1253926 Valid Input Validation and Logic – 2021-08-13 – 48 Password reset link not expiring after changing password in settings #1288898 Valid Authentication – 2021-08-10 $250 49 One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML #3943339 Valid Cross-site Scripting High 2026-10-02 – 49 launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API #3955956 Valid Authentication High 2026-10-30 – 49 Premium Email Address Check Bypass - Hey #963774 Valid Input Validation and Logic – 2020-12-15 – 53 Critical Data Breach - Big Data for all domains #2686225 Valid No weakness recorded Medium 2025-01-14 – 53 Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure #3543475 Valid Access Control Low 2026-04-14 – 53 Launchpad file read leaks production keys #3962925 Valid File and Path Handling Critical 2026-10-28 $9,337 55 Bypass of image rewriting / tracking blocker via srcset #1021885 Valid Information Disclosure – 2020-12-03 $1,000 56 Attachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket) #403602 Valid Input Validation and Logic – 2020-11-26 – 57 DNS Setup allows sending mail on behalf of other customers #981824 Valid Misconfiguration and Insecure Design – 2021-02-21 – 58 Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addresses #3445890 Valid Server-Side Request Forgery Medium 2025-12-22 – 62 Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click) #2553411 Valid File and Path Handling Medium 2024-07-09 – 65 Possible DOM XSS on app.hey.com #1010132 Valid Cross-site Scripting – 2020-10-27 – 68 Information Disclosure .htaccess accesible for public #1241849 Valid No weakness recorded – 2021-07-18 – 76 Stored XSS on trix editor version 2.1.1 #2521419 Valid Cross-site Scripting High 2024-11-04 $1,000 76 Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure #3467641 Valid Insecure Direct Object Reference Low 2026-03-16 $100 76 Subdomain Takeover due to ████████ NS records at us-east4.37signals.com #1342422 Valid Information Disclosure – 2021-09-17 – 77 Two click Account Takeover #3079738 Valid Deserialization and Object Injection High 2025-11-11 – 77 stored XSS in hey.com message content #988272 Valid Cross-site Scripting – 2020-10-31 – 80 DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover #3608199 Valid Cross-site Scripting High 2026-04-14 – 82 Mutation Based Stored XSS on Trix Editor version latest (2.1.8) #2819573 Valid No weakness recorded Critical 2025-06-27 – 89 Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass #3581911 Valid Cross-site Scripting Low 2026-07-14 $337 89 Insecure Bundler configuration fetching internal Gems (okra) from Rubygems.org #1104874 Valid Command and Code Injection – 2021-08-10 $5,000 102 Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity #3764217 Valid Access Control Medium 2026-07-04 – 104 Able to steal bearer token from deep link #1372667 Valid Authentication – 2022-03-27 $6,337 110 Spam & Clearance checks disabled with existing referenced Message-ID #2012659 Valid Access Control Low 2026-01-21 $250 123 User can upload files even after closing his account #1020371 Valid Authentication – 2021-03-29 – 124