Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Program	Weakness	Severity	Disclosed	Bounty	Votes
change part of personal information all usersAnalysed#2828693	Valid	Mars	Access Control	Critical	2025-05-12	–	53
PII of Users Disclosure using "/members/invite/" endpointAnalysed#787955	Valid	Lab45	Information Disclosure	High	2020-04-13	–	54
unauthorized access and add user and change personal information all usersAnalysed#2828641	Valid	Mars	Access Control	Critical	2025-05-27	–	54
Information disclosure via enabled Django Debug ModeAnalysed#2201370	Valid	MTN Group	Information Disclosure	Medium	2024-12-25	–	55
Graphql introspection is enabled and leaks details about the schemaAnalysed#1132803	Valid	On	Misconfiguration and Insecure Design	Low	2021-05-09	–	56
Broken Access Control Exposes Email Verification Status and Privacy Settings via API EndpointAnalysed#3114132	Valid	WakaTime	Access Control	Low	2025-04-29	–	57
Information disclosure on sim.starbucks.comAnalysed#632808	Valid	Starbucks	Information Disclosure	Low	2019-11-13	–	58
Определение id по номеру телефонаAnalysed#331040	Valid	VK.com	Information Disclosure	Medium	2018-05-06	$5,000	60
[affiliates.udemy.com] Wordpress user admin information discloureAnalysed#370777	Valid	Udemy	Information Disclosure	Low	2019-04-28	–	60
Email enumeration at SignUp pageAnalysed#666722	Valid	Omise	Information Disclosure	Low	2019-09-04	–	61
Insecure API Response Leads to Disclosure of Hashed PasswordsAnalysed#2788557	Valid	Mars	Information Disclosure	Medium	2024-11-26	–	61
User enumeration via timing attack in Django mod_wsgi authentication backend leads to account discoveryAnalysed#3424977	Valid	Django	No weakness recorded	–	2026-02-04	–	62
Exposure of account recovery hint by querying by user emailAnalysed#2256548	Valid	Mozilla	Information Disclosure	Low	2024-01-11	$250	64
User enumeration through forget passwordAnalysed#1166054	Valid	UPchieve	No weakness recorded	High	2021-05-16	–	66
Protected tweets exposure through the URLAnalysed#491473	Valid	X / xAI	Information Disclosure	High	2019-04-19	$560	67
No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)Analysed#1392287	Valid	XVIDEOS	No weakness recorded	Low	2021-11-23	$100	67
Sensitive Info Leak - An Attacker Can Retrieve All the Users Mobile Numbers at https://website-api.production.curve.app/api/waitlist/usAnalysed#902733	Valid	Curve	Cryptography	Medium	2020-10-23	–	79
inviting collaborator using email disclose the hackerone account related to the userAnalysed#2045722	Valid	HackerOne	Information Disclosure	Medium	2024-09-19	–	80
Unauthorized access to PII leads to Administrator account TakeoverAnalysed#2450685	Valid	MTN Group	Access Control	Critical	2025-02-22	–	82
Reading redacted data via hackbot's answersAnalysed#247628	Valid	HackerOne	Information Disclosure	Medium	2017-07-27	$1,500	93
Vulnerability in (*www.yoti.com) - Leads to Leakage of admin usernamesAnalysed#738615	Valid	Yoti	Information Disclosure	Medium	2020-12-11	–	93
Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeoverAnalysed#2748003	Valid	U.S. Dept Of Defense	Information Disclosure	Critical	2024-10-25	–	98
Can see phone numbers of others by providing mail addressAnalysed#2534458	Valid	LinkedIn	Information Disclosure	High	2024-11-13	–	111
Email enumeration of usersAnalysed#221869	Valid	Homebrew	Information Disclosure	Medium	2019-03-05	–	145
Discrepancy in hacker profile report count may reveal existence of a private program by publishing a reportAnalysed#410015	Valid	HackerOne	Information Disclosure	Medium	2019-04-24	$3,000	147
Twitter ID exposure via error-based side-channel attackAnalysed#505424	Valid	X / xAI	Information Disclosure	Medium	2019-05-16	$1,470	154
Discoverability by phone number/email restriction bypassAnalysed#1439026	Valid	X / xAI	Access Control	High	2022-02-11	$5,040	217
An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashierAnalysed#1966006	Valid	Unikrn	Insecure Direct Object Reference	High	2023-07-17	–	232

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,932 analysed so far), which can be wrong. Data as of 2026-11-15.