Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Lack of validation before assigning custom domain names leading to abuse of GitLab pages service#296907	Informative	Input Validation and Logic	–	2018-02-01	–	2
Cookie bomb#221041	Valid	Denial of Service	–	2018-02-16	–	6
Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7)#351554	Valid	Cross-site Scripting	–	2018-09-20	–	7
Potensial SSRF via Git repository URL#359288	Duplicate	Server-Side Request Forgery	–	2018-07-16	–	7
XSS (Persistent) - Selecting role(s) for protected branches#346111	Valid	Cross-site Scripting	–	2018-07-16	–	8
SSRF vulnerability in gitlab.com webhook#301924	Valid	Server-Side Request Forgery	–	2018-04-30	–	10
Persistent XSS - Selecting users as allowed merge request approvers#346217	Valid	Cross-site Scripting	–	2018-07-16	–	11
SSRF when importing a project from a git repo by URL#135937	Valid	Information Disclosure	–	2018-05-29	–	12
GitHub import allows user to create child group under existing namespace#301137	Valid	Access Control	–	2018-05-24	$750	14
Stored XSS on Issue details page#384255	Valid	Cross-site Scripting	–	2018-10-30	–	16
Stored XSS in merge request pages#409380	Valid	Cross-site Scripting	–	2018-12-03	–	18
HTML TAG INJECTION ON PROFILE NAME#358001	Valid	Cross-site Scripting	–	2018-07-27	–	19
Unauthorized users may be able to view almost all informations related to Private projects.#407763	Valid	Information Disclosure	–	2018-12-03	–	24
Vulnerability in project import leads to arbitrary command execution#378148	Valid	Command and Code Injection	–	2018-08-22	–	32
Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook#299473	Valid	Server-Side Request Forgery	–	2018-04-27	$750	36
Using GitLab to monitor and hijack domains in mass quantity.#312118	Valid	Input Validation and Logic	–	2018-02-21	$750	39
SQL injection in MilestoneFinder order method#298176	Valid	SQL Injection	–	2018-04-27	$2,000	41
GitLab CI runner can read and poison cache of all other projects#301432	Valid	File and Path Handling	–	2018-04-27	$2,000	43
Command injection by overwriting authorized_keys file through GitLab import#298873	Valid	Command and Code Injection	–	2018-04-27	$2,000	50

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.