Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating#3527788	Valid	Insecure Direct Object Reference	Medium	2026-08-25	–	46
PATs without the required scope can leak issues#3522254	Valid	Access Control	Medium	2026-03-19	–	59
GitHub user to server tokens can create issues in any public repository#3641229	Valid	Access Control	Medium	2026-07-22	–	62
Add labels to arbitrary issues/prs & compromise github actions label checks#3527771	Valid	Insecure Direct Object Reference	Medium	2026-03-19	–	71
OAuth redirect uri validation bypass for :proxima_first_party_sync apps#3588801	Valid	Open Redirect	High	2026-07-21	–	79
GitHub scoped user to server tokens can escape their installation#3638909	Valid	Access Control	High	2026-07-29	–	80
Missing Access Control in MigrationFile allows attacker to upload files to any Migration#3506183	Valid	Insecure Direct Object Reference	High	2026-03-05	–	92
Able to bypass authorization logic and gain more access then intended#3713965	Valid	No weakness recorded	Medium	2026-07-15	–	105
Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modification#3560256	Valid	Insecure Direct Object Reference	Medium	2026-05-19	–	108

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.