Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Stored XSS in File Upload Leads to Privilege Escalation and Full Workspace TakeoverAnalysed#3115705	Valid	Cross-site Scripting	High	2025-05-02	–	118
Privilege Persistence via Cloned AgentAnalysed#3114554	Valid	Access Control	Medium	2025-04-30	–	91
Privilege Escalation in Edit and Create Secret Endpoints Leads to Unauthorized Secret ModificationAnalysed#3103755	Valid	Access Control	High	2025-04-24	–	86
BAC – Bypass chatbot restrictions via unauthorized mention injectionAnalysed#3112106	Valid	No weakness recorded	Medium	2025-05-06	–	65
Race Condition in Folder Creation Allows Bypassing Folder LimitAnalysed#3104355	Valid	Input Validation and Logic	Medium	2025-04-29	–	65
UI flaw allows unauthorized users to add documents to restricted foldersAnalysed#3101986	Valid	Access Control	Medium	2025-04-23	–	57
Improper Session Invalidation – Auto Sign-In Without Credentials After Logout (Affects Chrome & Firefox)Analysed#3101207	Valid	Authentication	Medium	2025-04-29	–	56
Unauthorized Table Creation by MemberAnalysed#3101858	Valid	Access Control	Medium	2025-04-23	–	52
User Limit Bypass via Pending Invitations in Workspace SystemAnalysed#3102890	Valid	Input Validation and Logic	Medium	2025-04-29	–	51

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.