Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Relative Path Vulnerability Results in Arbitrary Command Execution/Privilege Escalation#784714 | Valid | Command and Code Injection | Medium | 2020-04-01 | $750 | 10 |
| Shared-channel BETA persists integration after unshare#291822 | Valid | Input Validation and Logic | Medium | 2018-04-25 | $750 | 13 |
| Information Disclosure on stun.screenhero.com#175061 | Valid | Information Disclosure | Medium | 2016-11-30 | $700 | 14 |
| Stored XSS in files.slack.com#827606 | Valid | Cross-site Scripting | Medium | 2021-12-02 | – | 19 |
| CSRF in github integration#174328 | Valid | Cross-Site Request Forgery | Medium | 2016-11-18 | $500 | 22 |
| HTTP parameter pollution from outdated Greenhouse.io JS dependencyAnalysed#335339 | Valid | Injection and Smuggling | Medium | 2018-07-19 | – | 26 |
| DoS on the Direct MessagesAnalysed#746003 | Valid | Denial of Service | Medium | 2020-11-11 | $500 | 29 |
| CSS Injection to disable app & potential message exfilAnalysed#679969 | Valid | Input Validation and Logic | Medium | 2019-11-09 | – | 37 |
| Private application files can be uploaded to Slack via malicious uploaderAnalysed#375083 | Valid | Information Disclosure | Medium | 2021-08-04 | $500 | 38 |
| The POODLE attack (SSLv3 supported) at status.slack.comAnalysed#375097 | Valid | Cryptography | Medium | 2018-11-28 | – | 44 |
| XSS on link and window.openerAnalysed#834071 | Valid | Cross-site Scripting | Medium | 2023-01-23 | $1,000 | 49 |
| Internal SSRF bypass using slash commands at api.slack.comAnalysed#356765 | Valid | Server-Side Request Forgery | Medium | 2018-07-12 | – | 51 |
| Bypass of the SSRF protection in Event Subscriptions parameter.Analysed#386292 | Valid | Server-Side Request Forgery | Medium | 2019-02-22 | – | 52 |
| Unauthorized access to GovSlackAnalysed#1758174 | Valid | Authentication | Medium | 2023-05-19 | $1,500 | 81 |
| SSRF in api.slack.com, using slash commands and bypassing the protections.Analysed#381129 | Valid | Server-Side Request Forgery | Medium | 2019-02-22 | – | 84 |
| Bypass invite accept for victimAnalysed#1663361 | Valid | Input Validation and Logic | Medium | 2023-02-17 | – | 84 |
| Header modification results in disclosure of Slack infra metadata to unauthorized partiesAnalysed#727330 | Valid | Server-Side Request Forgery | Medium | 2021-06-09 | – | 97 |
| Lack of URL normalization renders Blocked-Previews feature ineffectualAnalysed#1102764 | Valid | Other weaknesses | Medium | 2022-01-16 | $1,000 | 100 |
| Denial of Service via Hyperlinks in PostsAnalysed#1077136 | Valid | Denial of Service | Medium | 2021-10-03 | $1,500 | 109 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.