The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more su #1591504 N/A Authentication – 2022-06-15 – 3 Rate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact) #1578121 N/A No weakness recorded – 2022-06-15 – 7 Add me email address Authentication bypass #1607645 Informative No weakness recorded – 2022-07-15 – 8 Attacker can unpin posts from companies he's not part of. #1862677 Valid No weakness recorded – 2023-05-12 – 20 Campaign Account Balance and History Disclosed in API Response #1587374 Valid Insecure Direct Object Reference – 2022-11-30 – 21 [ Continuation Report from #1814842 ] Can create articles using other users' NewsLetters #1818969 Valid Insecure Direct Object Reference – 2023-05-15 – 23 “See who’s interested in working for your company” - security issue #1945417 Valid Information Disclosure – 2023-06-21 – 28 Ad Account Takeover #1791720 Valid Access Control – 2023-07-20 – 30 HTML injection at Company Name or Product Name and can be shown on Contact Sales form #2076019 Valid No weakness recorded – 2023-10-18 – 32 An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report] #1675674 Valid Input Validation and Logic – 2023-08-24 – 34 Deny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id} #2081744 Valid Access Control – 2023-10-19 – 34 Delete any LinkedIn comment on learning API of other users #1801527 Valid Access Control – 2023-05-12 – 41 bypass two-factor authentication. #1842183 Valid Authentication – 2023-08-01 – 41 CSRF that makes any user send invitations to the attacker by simply clicking on a link. #1961163 Valid Cross-Site Request Forgery – 2023-12-06 – 41 Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewed #1837309 Valid Insecure Direct Object Reference – 2023-05-17 – 43 Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning` #1813450 Valid Insecure Direct Object Reference – 2023-05-12 – 44 Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings] #1572591 Valid Access Control – 2022-08-26 – 48 IDOR - Delete technical skill assessment result & Gained Badges result of any user #1592587 Valid No weakness recorded – 2022-10-05 – 48 CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/* #1964211 Valid Cross-Site Request Forgery – 2023-12-06 – 53 Html injection in event Description #2215418 Valid Input Validation and Logic – 2024-01-29 – 55 Blocking a company page admin prevents him from delete paid media admin or edit his roles #2339192 Valid Access Control Medium 2026-03-05 – 55 User Details Can Be Disclosed Even If The Account IS In Hibernation State #1728087 Valid Information Disclosure – 2023-12-06 – 57 Users can access exams in course without having to subscribe to PREMIUM #1892888 Valid Access Control – 2024-01-10 – 64 Can access the job name, creator name and can report any draft/under review/rejected job #1581528 Valid Insecure Direct Object Reference – 2022-07-20 – 65 Attackers can *Upgrade and claim offer* on the Premium Trial Subscription with a total price of *IDR0.00* from the original *IDR7,022,061.82* #2131224 Valid Input Validation and Logic High 2024-06-18 – 70 Employee-only Area Bypass #2299571 Valid Access Control – 2024-02-19 – 77 Access to Deactivated LinkedIn Company Pages via Competitor Analytics API #3604288 Valid Insecure Direct Object Reference Medium 2026-03-24 – 77 Entire database of emails exposed through URN injection #1806939 Valid Command and Code Injection – 2023-05-22 – 79 Forced OAuth authorization using button ID in hash and holding space #2649615 Valid Authentication Medium 2024-12-17 – 79 Information disclosure by sending a GIF #1801427 Valid Input Validation and Logic – 2023-04-28 – 84 Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per month #1808719 Valid Insecure Direct Object Reference – 2023-08-24 – 84 IDOR to make someone attend or leave an event #1734639 Valid Insecure Direct Object Reference Medium 2026-03-06 – 87 Stored XSS on LinkedIn App via iframe tag in Article #2212950 Valid Cross-site Scripting – 2024-02-28 – 93 An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users. #2291999 Valid Insecure Direct Object Reference – 2024-03-12 – 94 IDOR allows an attacker to delete anyone's featured photo. #1608735 Valid Insecure Direct Object Reference – 2023-08-24 – 99 Improper Access Control - Access to "Active Hiring" (Premium feature) filter results #3235855 Valid Access Control Medium 2026-02-03 – 100 HTML Injection in LinkedIn Premium Support Chat #3079966 Valid No weakness recorded Low 2025-05-07 – 102 Can see phone numbers of others by providing mail address #2534458 Valid Information Disclosure High 2024-11-13 – 111 Unauthorized access to resumes stored on LinkedIn #1777095 Valid Insecure Direct Object Reference – 2022-12-07 – 112 Previous commentor on post can still comment even after comment permission is changed to disabled #3151001 Valid Access Control Low 2026-02-03 – 112 Unauthorized User can View Subscribers of Other Users Newsletters #1716300 Valid Insecure Direct Object Reference – 2023-03-29 – 117 Persistent XSS (unvalidated Open Graph embed) at LinkedIn.com #425007 Valid No weakness recorded – 2018-10-18 – 119 Session Cookie Leakage via Static Header Field in WebViewerFragment #3475626 Valid Misconfiguration and Insecure Design High 2026-03-17 – 131 Can delete other user's post and company page post #337755 Valid Access Control – 2023-04-11 – 156