Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more su#1591504	N/A	Authentication	Medium	2022-06-15	–	3
Rate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact)#1578121	N/A	No weakness recorded	–	2022-06-15	–	7
Add me email address Authentication bypass#1607645	Informative	No weakness recorded	–	2022-07-15	–	8
Campaign Account Balance and History Disclosed in API ResponseAnalysed#1587374	Valid	Insecure Direct Object Reference	Medium	2022-11-30	–	21
Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]Analysed#1572591	Valid	Access Control	Medium	2022-08-26	–	48
IDOR - Delete technical skill assessment result & Gained Badges result of any userAnalysed#1592587	Valid	No weakness recorded	Medium	2022-10-05	–	48
Can access the job name, creator name and can report any draft/under review/rejected jobAnalysed#1581528	Valid	Insecure Direct Object Reference	Medium	2022-07-20	–	65
Unauthorized access to resumes stored on LinkedInAnalysed#1777095	Valid	Insecure Direct Object Reference	High	2022-12-07	–	112

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.