Intel · bug bounty

Disclosed bug bounty reports

Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.

SortMost upvoted

StatusAny

SeverityAny

DisclosedAny year

WeaknessAny class

Access (title)Any

Access (analysis)A user account

TechniqueAny

Clear

78 of 15,219 reports · $443,970 in bounties · 161 analysed so far

#867513ValidAnalysedTakeover an account that doesn't have a Shopify ID and moreShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Business logic flaw–3,006votes
#791775ValidAnalysedEmail Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Authentication bypass–1,922votes
#827052ValidAnalysedArbitrary file read via the UploadsRewriter when moving and issueGitLab · File and Path Handling · 2020 · needs: a user account · Path traversal, Local file inclusion$20,0001,503votes
#921780ValidAnalysedImproper Authentication - any user can login as other user with otp/logout & otp/loginSnapchat · Authentication · 2021 · needs: a user account · Authentication bypass, Account takeover chain, IDOR / object reference–972votes
#796808ValidAnalysed[Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain–894votes
#422944ValidAnalysedH1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsShopify · Command and Code Injection · 2020 · needs: a user account · Unsafe file upload, OS command injection, SSRF–830votes
#403417ValidAnalysedRemote Code Execution on www.semrush.com/my_reports on Logo uploadSemrush · Command and Code Injection · 2019 · needs: a user account · OS command injection, Unsafe file upload–824votes
#1819832ValidAnalysedDelete anyone's content spotlight remotely.Snapchat · Insecure Direct Object Reference · 2023 · needs: a user account · IDOR / object reference, Missing authorisation check$15,000801votes
#415081ValidAnalysedIDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersPayPal · Insecure Direct Object Reference · 2019 · needs: a user account · IDOR / object reference, Missing authorisation check$10,500797votes
#873614ValidAnalysedWebsites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationPlayStation · Command and Code Injection · 2020 · needs: a user account · Code injection / eval$15,000780votes
#658013ValidAnalysedGit flag injection - local file overwrite to remote code executionGitLab · Command and Code Injection · 2019 · needs: a user account · OS command injection, Path traversal$12,000777votes
#446585ValidAnalysedExfiltrate and mutate repository and project data through injected templated serviceGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, Information disclosure, SSRF$11,000762votes
#826026ValidAnalysedUse-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W PrimitivesPlayStation · Memory Corruption · 2020 · needs: a user account · Race condition, Memory corruption, Privilege escalation$10,000741votes
#506646ValidAnalysedWebshell via File Upload on ecjobs.starbucks.com.cnStarbucks · Command and Code Injection · 2019 · needs: a user account · Unsafe file upload, OS command injection–688votes
#792927ValidAnalysedEmail address of any user can be queried on Report Invitation GraphQL type when username is knownHackerOne · Access Control · 2020 · needs: a user account · Missing authorisation check, Information disclosure–671votes
#391217ValidAnalysedGetting all the CD keys of any gameValve · Access Control · 2018 · needs: a user account · Missing authorisation check, IDOR / object reference, Information disclosure$20,000638votes
#526325ValidAnalysedStored XSS in Wiki pagesGitLab · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–633votes
#129873ValidAnalysedBypassing Digits origin validation which leads to account takeoverX / xAI · Authentication · 2020 · needs: a user account · Authentication bypass, postMessage flaw, Account takeover chain–619votes
#484434ValidAnalysedStored XSS on imgur profileImgur · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–614votes
#807448ValidAnalysedCustomer private program can disclose email any users through invited via usernameHackerOne · Information Disclosure · 2020 · needs: a user account · Information disclosure, Missing authorisation check$7,500589votes
#639684ValidAnalysedThe return of the ＜Rockstar Games · Cross-site Scripting · 2019 · needs: a user account · Stored XSS$1,000576votes
#910300ValidAnalysedEmail Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationShopify · Access Control · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Authentication bypass–559votes
#544928ValidAnalysedPrivilege Escalation From user to SYSTEM via unauthenticated command executionUbiquiti Inc. · Command and Code Injection · 2019 · needs: a user account · OS command injection, Privilege escalation–553votes
#587854ValidAnalysedLocal files could be overwritten in GitLab, leading to remote command executionGitLab · Command and Code Injection · 2019 · needs: a user account · Path traversal, OS command injection$12,000542votes
#740989ValidAnalysedShopify Stocky App OAuth MisconfigurationShopify · Access Control · 2019 · needs: a user account · Authentication bypass, Privilege escalation–527votes
#783877ValidAnalysedRemote Code Execution in Slack desktop apps + bonusSlack · Command and Code Injection · 2020 · needs: a user account · Code injection / eval, Open redirect, Stored XSS–509votes
#1154542ValidAnalysedRCE when removing metadata with ExifToolGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval, Unsafe file upload$20,000508votes
#764434ValidAnalysedprofile-picture name parameter with large value lead to DoS for other users and programs on the platformHackerOne · Denial of Service · 2020 · needs: a user account · Denial of service, Business logic flaw–475votes
#689314ValidAnalysedProject Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, IDOR / object reference, Privilege escalation$12,000457votes
#1010466ValidAnalysedBlind XSS on image uploadCS Money · Cross-site Scripting · 2020 · needs: a user account · Stored XSS, CSRF$1,000450votes
#1295844ValidAnalysedModify in-flight data to payment provider Smart2PayValve · Input Validation and Logic · 2021 · needs: a user account · Business logic flaw, Parameter pollution, Price or quantity tampering$7,500443votes
#1342088ValidAnalysedFlickr Account Takeover using AWS Cognito APIFlickr · Authentication · 2021 · needs: a user account · Account takeover chain, Authentication bypass, E-mail verification bypass–440votes
#231460ValidAnalysedOpen prod Jenkins instanceSnapchat · Information Disclosure · 2017 · needs: a user account · Missing authorisation check, Information disclosure, Leaked secret or key, Code injection / eval$15,000436votes
#2032716ValidAnalysedAn attacker can can view any hacker email via /SaveCollaboratorsMutation operation nameHackerOne · Information Disclosure · 2023 · needs: a user account · Information disclosure$12,500429votes
#1125425ValidAnalysedRCE via unsafe inline Kramdown options when rendering certain Wiki pagesGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval$20,000427votes
#530974ValidAnalysedServer-Side Request Forgery using Javascript allows to exfill data from Google MetadataSnapchat · Server-Side Request Forgery · 2020 · needs: a user account · SSRF, SSRF through a redirect, Information disclosure, Leaked secret or key–421votes
#365271ValidAnalysedRemote code execution on Basecamp.comBasecamp · Command and Code Injection · 2020 · needs: a user account · OS command injection, Unsafe file upload$5,000417votes
#850447ValidAnalysedgitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readGitLab · Information Disclosure · 2020 · needs: a user account · Missing authorisation check, Information disclosure, Path traversal$10,000410votes
#423541ValidAnalysedH1514 Server Side Template Injection in Return Magic email templates?Shopify · Command and Code Injection · 2019 · needs: a user account · Template injection–409votes
#643908ValidAnalysedStored XSS VulnerabilityWordPress · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–403votes
#1032468ValidAnalysedRead-only application can publish/delete fleetsX / xAI · Access Control · 2021 · needs: a user account · Missing authorisation check, Privilege escalation–398votes
#2122671ValidAnalysedIDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryHackerOne · Insecure Direct Object Reference · 2023 · needs: a user account · IDOR / object reference, Missing authorisation check–395votes
#1679624ValidAnalysedRemote Command Execution via Github importGitLab · Command and Code Injection · 2022 · needs: a user account · OS command injection, Unsafe deserialisation$33,510392votes
#1609965ValidAnalysedRCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)GitLab · Command and Code Injection · 2022 · needs: a user account · OS command injection$33,510387votes
#3862641ValidAnalysedIDOR allows user to access report details via reference.json endpointHackerOne · Insecure Direct Object Reference · 2026 · Critical · needs: a user account · IDOR / object reference, Information disclosure, Missing authorisation check$15,000372votes
#423467ValidAnalysedH1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsShopify · Input Validation and Logic · 2019 · needs: a user account · Weak cryptography, Business logic flaw, Information disclosure–372votes
#1858574ValidAnalysed[CVE-2022-44268] Arbitrary Remote Leak via ImageMagickHackerOne · File and Path Handling · 2023 · needs: a user account · Local file inclusion, Unsafe file upload, Information disclosure, Leaked secret or key–371votes
#509924ValidAnalysedJSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsGitLab · Information Disclosure · 2019 · needs: a user account · IDOR / object reference, Missing authorisation check, Information disclosure, Leaked secret or key$12,000366votes
#409395ValidAnalysedBypass of GitLab CI runner slash fix in YAML validationGitLab · Input Validation and Logic · 2019 · needs: a user account · Path traversal, Business logic flaw–363votes
#481472ValidAnalysedURL link spoofingSlack · Input Validation and Logic · 2020 · needs: a user account · Open redirect, Business logic flaw$250362votes

The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.