Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating#3527788	Valid	Insecure Direct Object Reference	Medium	2026-08-25	–	46
RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention#2357443	Valid	Misconfiguration and Insecure Design	Medium	2024-09-17	–	50
PATs without the required scope can leak issues#3522254	Valid	Access Control	Medium	2026-03-19	–	59
GitHub user to server tokens can create issues in any public repository#3641229	Valid	Access Control	Medium	2026-07-22	–	62
View private repository NWO of deploy key via internal LFS API#2469713	Valid	Access Control	Medium	2024-07-23	–	70
Add labels to arbitrary issues/prs & compromise github actions label checks#3527771	Valid	Insecure Direct Object Reference	Medium	2026-03-19	–	71
Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)#2505761	Valid	Information Disclosure	Medium	2024-10-17	$4,000	72
GitHub Apps can access suspended installations via scoped user-to-server tokens#2484635	Valid	Access Control	Medium	2024-07-31	–	90
Access body and title of Internal Repo Issues in Projects#2501036	Valid	Information Disclosure	Medium	2024-07-31	–	100
Able to bypass authorization logic and gain more access then intended#3713965	Valid	No weakness recorded	Medium	2026-07-15	–	105
Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modification#3560256	Valid	Insecure Direct Object Reference	Medium	2026-05-19	–	108

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.