Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Possibility to freeze/crash the host system of all Slack Desktop users easily#392728	Valid	Misconfiguration and Insecure Design	Low	2020-11-10	–	9
Relative Path Vulnerability Results in Arbitrary Command Execution/Privilege Escalation#784714	Valid	Command and Code Injection	Medium	2020-04-01	$750	10
Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#238260	Valid	Authentication	Low	2020-11-10	$500	18
DoS on the Direct MessagesAnalysed#746003	Valid	Denial of Service	Medium	2020-11-11	$500	29
URL filter bypass in Enterprise GridAnalysed#500348	Valid	Input Validation and Logic	Low	2020-02-14	$100	32
Slack-Corp Heroku application disclosing limited info about company membersAnalysed#966814	Valid	Information Disclosure	Low	2020-12-09	–	39
Access to some Slack workspace metadata and settings available to unauthorized partiesAnalysed#130133	Valid	Authentication	–	2020-11-10	$7,000	60
Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersAnalysed#833080	Valid	File and Path Handling	High	2020-06-30	$1,500	101
Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackAnalysed#531032	Valid	Cryptography	High	2020-03-12	$2,000	170
TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesAnalysed#333419	Valid	Server-Side Request Forgery	Critical	2020-03-12	$3,500	323
URL link spoofingAnalysed#481472	Valid	Input Validation and Logic	Low	2020-04-26	$250	362
Remote Code Execution in Slack desktop apps + bonusAnalysed#783877	Valid	Command and Code Injection	Critical	2020-08-28	–	509
Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesAnalysed#737140	Valid	Injection and Smuggling	Critical	2020-03-12	–	870

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.