Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Bypassing HackerOne 2FA due to race conditionAnalysed#2598548	Valid	Input Validation and Logic	Medium	2024-10-30	–	139
Team object in GraphQL discloses team group names and permissionsAnalysed#343464	Valid	Information Disclosure	Medium	2018-05-04	$2,500	75
Being able to disclose IBB bounty table of any public programAnalysed#2322082	Valid	Information Disclosure	Medium	2024-03-17	–	72
The request tells the number of private programs, the new system of authorization /invite/tokenAnalysed#310946	Valid	Information Disclosure	Medium	2018-02-14	$2,000	71
Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpointAnalysed#2357012	Valid	No weakness recorded	Medium	2024-05-24	–	60
New Search Feature: Search for non-public words in limited disclosure reportsAnalysed#2213251	Valid	Information Disclosure	Medium	2023-10-25	–	55
Adding or removing a new non-preferred payout method does not trigger an e-mail or account notificationAnalysed#242964	Valid	Input Validation and Logic	Medium	2017-11-01	–	46
HackerOne reports escalation to JIRA is CSRF vulnerableAnalysed#226418	Valid	Cross-Site Request Forgery	Medium	2017-08-30	$500	36
Internal machine learning API endpoint for CWE classification is vulnerable to path traversalAnalysed#2032778	Valid	File and Path Handling	Medium	2023-07-05	–	33
View Any Program's Team Members through GET https://hackerone.com/invitations/Analysed#283014	Valid	Information Disclosure	Medium	2017-11-01	$1,000	32
Unicorn worker pool exhaustion by continuously updating payout preferencesAnalysed#317543	Valid	Denial of Service	Medium	2018-03-30	–	25

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.