Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Unauthenticated blind SSRF in OAuth Jira authorization controllerAnalysed#398799 | Valid | Server-Side Request Forgery | High | 2019-03-14 | $4,000 | 238 |
| Ability To Delete User(s) Account Without User InteractionAnalysed#928255 | Valid | Misconfiguration and Insecure Design | High | 2021-03-17 | – | 221 |
| Group search leaks private MRs, code, commitsAnalysed#692252 | Valid | Access Control | High | 2019-12-14 | – | 212 |
| information disclosure of secret_key_base via encoding charctersAnalysed#460545 | Valid | Information Disclosure | High | 2019-06-13 | $3,500 | 146 |
| CSRF on /api/graphql allows executing mutations through GET requestsAnalysed#1122408 | Valid | Cross-Site Request Forgery | High | 2021-08-02 | $3,370 | 88 |
| Cache poisoning Denial of Service affecting assets.gitlab-static.netAnalysed#1160407 | Valid | Denial of Service | High | 2021-12-22 | – | 83 |
| SafeParamsHelper::safe_params is not so safeAnalysed#946728 | Valid | Cross-site Scripting | High | 2020-11-02 | $4,000 | 24 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.