Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Program	Weakness	Severity	Disclosed	Bounty	Votes
June 2022 Incident ReportAnalysed#1622449	Valid	HackerOne	No weakness recorded	Critical	2022-07-01	–	426
Account takeover of existing HackerOne accounts through SCIM provisioningAnalysed#3178999	Valid	HackerOne	Access Control	High	2025-07-17	–	232
Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Analysed#1596663	Valid	Reddit	Access Control	High	2022-11-14	–	186
SQL injection in structure pluginAnalysed#3249794	Valid	ExpressionEngine	SQL Injection	Medium	2026-01-26	–	125
SQL injection on admin.acronis.host development web serviceAnalysed#923020	Valid	Acronis	SQL Injection	–	2021-06-22	$250	118
Remote Code Execution (Reverse Shell) - File ManagerAnalysed#768322	Valid	Concrete CMS	Command and Code Injection	–	2020-07-21	–	114
Read files on application server, leads to RCEAnalysed#178152	Valid	GitLab	Information Disclosure	–	2016-11-03	–	114
Cross-Site Request ForgeryAnalysed#2041007	Valid	ownCloud	Cross-Site Request Forgery	High	2023-11-05	–	111
ISteamAssets gives partners control over unrelated community market transactionsAnalysed#577584	Valid	Valve	Access Control	–	2019-05-23	–	109
Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationAnalysed#3560256	Valid	GitHub	Insecure Direct Object Reference	Medium	2026-05-19	–	108
connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invitesAnalysed#1474536	Valid	8x8	Access Control	High	2023-02-15	–	105
Mass account takeover!Analysed#1634165	Valid	Stripe	Misconfiguration and Insecure Design	High	2022-12-21	–	101
Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)Analysed#3572848	Valid	Nextcloud	Access Control	Medium	2026-05-21	$150	100

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.