Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Confidential issues leaked in public projects when attached to milestone#134300	Valid	Information Disclosure	–	2016-05-03	–	5
Attacker can delete (and read) private project webhooks#134292	Valid	Access Control	–	2016-05-03	–	6
Attacker can post notes on private MR, snippets, and issues#134299	Valid	Access Control	–	2016-05-03	–	6
Labels created in private projects are leaked#132777	Valid	Information Disclosure	–	2016-05-03	–	7
Private snippets in public / internal projects leaked though GitLab API#134305	Valid	Information Disclosure	–	2016-05-03	–	7
Persistent XSS on public project page#129736	Valid	Cross-site Scripting	–	2016-05-03	–	8
Attacker can extract list of private project's project members#128051	Valid	Information Disclosure	–	2016-08-01	–	10
Boards leak private label names and desciptions#162147	Valid	Information Disclosure	–	2016-09-02	–	10
XSS On meta tags in profile page#159984	Valid	Cross-site Scripting	–	2016-08-21	–	11
State filter in IssuableFinder allows attacker to delete all issues and merge requests#186194	Valid	Access Control	–	2016-12-06	–	11
Persistent XSS on public wiki pages#136333	Valid	Cross-site Scripting	–	2016-07-27	–	14
Privilege escalation to access all private groups and repositories#131210	Valid	Access Control	–	2016-07-27	–	17
Bypassing password authentication of users that have 2FA enabled#128085	Valid	Authentication	–	2016-04-18	–	27
Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com#174983	Valid	Access Control	–	2016-12-06	–	31
Insecure 2FA/authentication implementation creates a brute force vulnerability#149598	Valid	Misconfiguration and Insecure Design	–	2016-10-28	–	33
Ability to access all user authentication tokens, leads to RCE#158330	Valid	Access Control	–	2016-11-03	–	61
Read files on application server, leads to RCE#178152	Valid	Information Disclosure	–	2016-11-03	–	114

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.