Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Broken Access Control (IDOR) in Booking Detail and Bids Could Leads to Sensitive Information DisclosureAnalysed#2374730	Valid	Insecure Direct Object Reference	High	2025-06-13	–	108
Improper Access Control Allows Trip Hijacking and Passenger/Driver PII DisclosureAnalysed#2867022	Valid	Insecure Direct Object Reference	Medium	2025-06-26	–	80
Exposed trip_no in WebSocket Responses Leading to Excessive information DisclosureAnalysed#2209750	Valid	Access Control	Medium	2025-06-26	–	64
Bypassing Bronze Partner Wallet Restriction to Accept Trips with Negative BalanceAnalysed#2868164	Valid	Input Validation and Logic	Medium	2025-06-13	–	63
Lack of Feedback Validation Permits Arbitrary Driver RatingsAnalysed#2894018	Valid	Insecure Direct Object Reference	Medium	2025-06-12	–	60
Lack of minimum value bid wheel verification on customer_bid in Rental TripsAnalysed#3328343	Valid	Input Validation and Logic	Low	2025-11-20	–	55
Customer can cancel a individual booking in a batch, causing locking of partner.Analysed#3295503	Valid	Input Validation and Logic	Medium	2025-11-20	–	49

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.