Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Account takeover via leaked session cookieAnalysed#745324	Valid	Authentication	High	2019-12-03	$20,000	1,642
View Titles of Private Reports with pending email invitationAnalysed#2312029	Valid	Access Control	High	2024-01-16	–	257
HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organizationAnalysed#2101076	Valid	Memory Corruption	High	2024-02-04	–	228
Internal Access to Hackerone confluence DocsAnalysed#3113398	Valid	Misconfiguration and Insecure Design	High	2025-08-15	$12,500	227
Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne usersAnalysed#1034346	Valid	Insecure Direct Object Reference	High	2020-11-17	–	91
Unauthenticated user can upload an attachment to the last updated report draftAnalysed#419896	Valid	Memory Corruption	High	2018-10-09	–	87
Improper UUID validation results in bypass of #419896Analysed#423073	Valid	Input Validation and Logic	High	2018-10-25	–	82
Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program detailsAnalysed#447930	Valid	Insecure Direct Object Reference	High	2019-01-11	–	54

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.