Remote code execution on Basecamp.com Analysed #365271 Valid Command and Code Injection Critical 2020-11-26 $5,000 417 AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp Analysed #2107680 Valid Information Disclosure High 2023-09-21 $8,868 248 Account takeover via insecure intent handling Analysed #2516732 Valid Deserialization and Object Injection Medium 2024-05-30 – 136 a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of service Analysed #1018037 Valid Denial of Service High 2020-11-10 $1,000 132 User can upload files even after closing his account Analysed #1020371 Valid Authentication – 2021-03-29 – 124 Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass Analysed #3581911 Valid Cross-site Scripting Low 2026-07-14 $337 89 DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover Analysed #3608199 Valid Cross-site Scripting High 2026-04-14 – 82 stored XSS in hey.com message content Analysed #988272 Valid Cross-site Scripting Medium 2020-10-31 – 80 Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure Analysed #3467641 Valid Insecure Direct Object Reference Low 2026-03-16 $100 76 Stored XSS on trix editor version 2.1.1 Analysed #2521419 Valid Cross-site Scripting High 2024-11-04 $1,000 76 Possible DOM XSS on app.hey.com Analysed #1010132 Valid Cross-site Scripting High 2020-10-27 – 68 Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click) Analysed #2553411 Valid File and Path Handling Medium 2024-07-09 – 65 Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addresses Analysed #3445890 Valid Server-Side Request Forgery Medium 2025-12-22 – 62 DNS Setup allows sending mail on behalf of other customers Analysed #981824 Valid Misconfiguration and Insecure Design Medium 2021-02-21 – 58 Attachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket) Analysed #403602 Valid Input Validation and Logic High 2020-11-26 – 57 Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure Analysed #3543475 Valid Access Control Low 2026-04-14 – 53 launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API Analysed #3955956 Valid Authentication High 2026-10-30 – 49 Password reset link not expiring after changing password in settings Analysed #1288898 Valid Authentication Low 2021-08-10 $250 49 Remote Code Execution in Basecamp Windows Electron App Analysed #1016966 Valid Command and Code Injection High 2020-11-19 – 48 CSRF on launchpad.37signals.com OAuth2 authorization endpoint Analysed #850022 Valid Cross-Site Request Forgery High 2020-10-30 – 44 Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook Analysed #3979217 Valid Authentication High 2026-10-30 – 34 A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option Analysed #3999856 Valid Access Control High 2026-10-30 – 33 Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com Analysed #2552879 Valid Deserialization and Object Injection Medium 2024-07-09 – 31