Denial of service via cache poisoning Analysed #409370 Valid Denial of Service Medium 2018-12-22 $2,500 253 Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack Analysed #1181946 Valid Denial of Service Medium 2021-12-22 – 228 Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information Analysed #2937622 Valid Information Disclosure Medium 2025-05-31 – 226 Google Docs link in JS files allows editing & reading survey information Analysed #2180521 Valid Information Disclosure Medium 2023-11-04 – 217 Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos Analysed #1034257 Valid Misconfiguration and Insecure Design Medium 2021-03-25 – 194 Unauthorized access to metadata of undisclosed reports that were retested Analysed #871749 Valid Information Disclosure Medium 2020-06-05 – 189 Disclosure of `payment_transactions` for programs via GraphQL query Analysed #707433 Valid Information Disclosure Medium 2019-12-01 – 178 Team object in GraphQL disclosed private_comment Analysed #978143 Valid Information Disclosure Medium 2020-09-10 $2,500 146 h1-202 leaderboard photo discloses local wifi password Analysed #329798 Valid Authentication Medium 2018-03-25 – 145 Unauthorized user can obtain `report_sources` attribute through Team GraphQL object Analysed #770209 Valid Information Disclosure Medium 2020-02-10 $2,500 142 Takeover of hackerone.engineering via Github Analysed #2085260 Valid Access Control Medium 2023-07-31 – 135 Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com Analysed #374919 Valid Cross-site Scripting Medium 2018-08-04 – 129 Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget Analysed #1598347 Valid Cross-site Scripting Medium 2023-03-10 – 122 GraphQL field on Team node can be used to determine if External Program runs invite-only program Analysed #877642 Valid Information Disclosure Medium 2020-07-25 $2,500 107 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report Analysed #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 Team object in GraphQL disclosed total number of whitelisted hackers Analysed #342978 Valid Information Disclosure Medium 2018-05-12 $2,500 93 Scope information is leaked when visiting policy scopes tab of any External Program Analysed #1868473 Valid Access Control Medium 2023-03-10 – 86 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs Analysed #215625 Valid Information Disclosure Medium 2017-05-23 $2,000 75 Residual Malicious Payloads on HackerOne after Vulnerability Fixes Analysed #3168691 Valid Input Validation and Logic Medium 2026-04-16 – 72 Homograph fix Bypass Analysed #271324 Valid Misconfiguration and Insecure Design Medium 2017-10-16 – 71 Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering Analysed #1132606 Valid Information Disclosure Medium 2021-08-24 – 66 Partial report contents leakage - via HTTP/2 concurrent stream handling Analysed #493176 Valid Information Disclosure Medium 2021-08-05 $2,500 64 Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile Analysed #347693 Valid Information Disclosure Medium 2018-05-08 $2,500 64 Query parameter reordering causes redirect page to render unsafe URL Analysed #293689 Valid Cross-site Scripting Medium 2017-11-30 $1,500 61 Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects Analysed #781175 Valid Access Control Medium 2020-03-20 – 59 Team object exposes amount of participants in a private program to non-invited users Analysed #380317 Valid Information Disclosure Medium 2018-07-20 – 59 GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend Analysed #800231 Valid Information Disclosure Medium 2020-05-11 – 42 Changing Victim's JIRA Integration Settings Through Multiple Bugs Analysed #226199 Valid Input Validation and Logic Medium 2017-05-23 $1,000 36 Private information exposed through GraphQL search endpoints aggregates Analysed #1838329 Valid Information Disclosure Medium 2023-01-19 – 32 Program profile metrics endpoint contains mean time to triage, even when turned off Analysed #289568 Valid Information Disclosure Medium 2017-11-14 – 29 Can read features from any user Analysed #316810 Valid Information Disclosure Medium 2018-03-12 $250 28 Information Disclosure when /invitations/<token>.json is not yet accepted Analysed #290930 Valid Information Disclosure Medium 2019-12-06 – 25