Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.#1161141	Informative	Information Disclosure	Critical	2021-04-30	–	16
Accidental Access to Programs Information via SAML LoginAnalysed#438306	Valid	No weakness recorded	Critical	2018-11-14	–	34
View any user email using the Team's audit log section#2404415	Duplicate	Information Disclosure	Critical	2024-03-26	–	61
Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery#2501984	Informative	Authentication	Critical	2024-07-11	–	67
Creation of bounties through Customer API leads to private email disclosureAnalysed#2382120	Valid	Information Disclosure	Critical	2024-03-26	–	101
SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterAnalysed#435066	Valid	SQL Injection	Critical	2018-11-30	–	174
Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json EndpointAnalysed#2487889	Valid	Insecure Direct Object Reference	Critical	2024-05-23	–	266
Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`Analysed#1618347	Valid	No weakness recorded	Critical	2025-01-21	$25,000	295
Attachment disclosure via summary reportAnalysed#2442008	Valid	Insecure Direct Object Reference	Critical	2024-04-29	–	340
[CVE-2022-44268] Arbitrary Remote Leak via ImageMagickAnalysed#1858574	Valid	File and Path Handling	Critical	2023-03-16	–	371
IDOR allows user to access report details via reference.json endpointAnalysed#3862641	Valid	Insecure Direct Object Reference	Critical	2026-10-01	$15,000	372
June 2022 Incident ReportAnalysed#1622449	Valid	No weakness recorded	Critical	2022-07-01	–	426
Server Side Request Forgery (SSRF) via Analytics ReportsAnalysed#2262382	Valid	Server-Side Request Forgery	Critical	2023-12-08	$25,000	529
The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentAnalysed#3000510	Valid	Information Disclosure	Critical	2025-04-01	–	625
Confidential data of users and limited metadata of programs and reports accessible via GraphQLAnalysed#489146	Valid	Information Disclosure	Critical	2019-02-03	–	1,033

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.