Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution#224198	Informative	Misconfiguration and Insecure Design	–	2017-06-28	–	–
Lack of validation before assigning custom domain names leading to abuse of GitLab pages service#296907	Informative	Input Validation and Logic	–	2018-02-01	–	2
Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities#874401	Informative	Information Disclosure	–	2021-11-15	–	2
Arbitrary escape sequence injection in docker-machine from worker nodes#1916285	Informative	Command and Code Injection	–	2023-06-02	–	5
Stored-XSS in merge requests#1261148	Informative	Cross-site Scripting	–	2021-07-19	–	6
Found Origin IP's lead to access to gitlab#1637577	Informative	Access Control	–	2022-08-02	–	6
Dependecy Confusion via Lookup Request Forwarding to PyPi.org#1681275	Informative	Misconfiguration and Insecure Design	–	2022-11-21	–	6
Responsible Disclosure of Privacy Leakage Issue#1089914	Informative	Information Disclosure	–	2021-06-29	–	7
Bypass for Domain-level redirects (Unvalidated Redirects and Forwar)#1582160	Informative	Open Redirect	–	2022-06-22	–	7
Container escape on public GitLab CI runners#1442118	Informative	Access Control	–	2022-04-27	–	12
Unauthorized access#1669176	Informative	Access Control	–	2022-08-25	–	18
Removed Guest role user who dosent have access to private project in members able to view jobs#2668302	Informative	Access Control	None	2024-09-18	–	38
Login email verification bypass via `/oauth/token`.#2676025	Informative	Authentication	None	2024-09-03	–	66

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.