Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Access body and title of Internal Repo Issues in ProjectsAnalysed#2501036	Valid	Information Disclosure	Medium	2024-07-31	–	100
GitHub Apps can access suspended installations via scoped user-to-server tokensAnalysed#2484635	Valid	Access Control	Medium	2024-07-31	–	90
Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)Analysed#2505761	Valid	Information Disclosure	Medium	2024-10-17	$4,000	72
Add labels to arbitrary issues/prs & compromise github actions label checksAnalysed#3527771	Valid	Insecure Direct Object Reference	Medium	2026-03-19	–	71
PATs without the required scope can leak issuesAnalysed#3522254	Valid	Access Control	Medium	2026-03-19	–	59
Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository TransferAnalysed#2190827	Valid	Access Control	Medium	2024-03-15	–	57
Managing PagesAnalysed#1690427	Valid	Access Control	Medium	2022-12-22	–	54
Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gatingAnalysed#3527788	Valid	Insecure Direct Object Reference	Medium	2026-08-25	–	46
[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissionsAnalysed#2184950	Valid	Access Control	Medium	2024-01-03	–	42
Smuggling content in PR with refs/replace in GitHubAnalysed#1938106	Valid	Injection and Smuggling	Medium	2023-08-01	–	35
[PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permissionAnalysed#2209433	Valid	Access Control	Medium	2024-01-03	–	31
Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code ExecutionAnalysed#2017600	Valid	Injection and Smuggling	Medium	2023-11-29	–	25

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.