Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Blocking a company page admin prevents him from delete paid media admin or edit his rolesAnalysed#2339192 | Valid | Access Control | Medium | 2026-03-05 | – | 55 |
| Access to Deactivated LinkedIn Company Pages via Competitor Analytics APIAnalysed#3604288 | Valid | Insecure Direct Object Reference | Medium | 2026-03-24 | – | 77 |
| IDOR to make someone attend or leave an eventAnalysed#1734639 | Valid | Insecure Direct Object Reference | Medium | 2026-03-06 | – | 87 |
| Improper Access Control - Access to "Active Hiring" (Premium feature) filter resultsAnalysed#3235855 | Valid | Access Control | Medium | 2026-02-03 | – | 100 |
| Previous commentor on post can still comment even after comment permission is changed to disabledAnalysed#3151001 | Valid | Access Control | Low | 2026-02-03 | – | 112 |
| Session Cookie Leakage via Static Header Field in WebViewerFragmentAnalysed#3475626 | Valid | Misconfiguration and Insecure Design | High | 2026-03-17 | – | 131 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.