Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Access body and title of Internal Repo Issues in ProjectsAnalysed#2501036	Valid	Information Disclosure	Medium	2024-07-31	–	100
GitHub Apps can access suspended installations via scoped user-to-server tokensAnalysed#2484635	Valid	Access Control	Medium	2024-07-31	–	90
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-checkAnalysed#2325023	Valid	Command and Code Injection	High	2024-09-17	–	88
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forwardAnalysed#2332623	Valid	Command and Code Injection	High	2024-09-13	–	80
Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)Analysed#2505761	Valid	Information Disclosure	Medium	2024-10-17	$4,000	72
Source Code and data exfiltration via Github CopilotAnalysed#2383092	Valid	Command and Code Injection	Low	2024-08-19	–	63
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injectionAnalysed#2332551	Valid	Command and Code Injection	High	2024-09-13	–	61
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ngAnalysed#2329466	Valid	Command and Code Injection	High	2024-09-13	–	61
Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository TransferAnalysed#2190827	Valid	Access Control	Medium	2024-03-15	–	57
GHES Management console EoP (editor to site admin)Analysed#2197796	Valid	Access Control	High	2024-01-08	–	56
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectdAnalysed#2329547	Valid	Command and Code Injection	High	2024-09-17	–	47
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-consoleAnalysed#2323292	Valid	Command and Code Injection	High	2024-09-17	–	47
[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissionsAnalysed#2184950	Valid	Access Control	Medium	2024-01-03	–	42
[PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permissionAnalysed#2209433	Valid	Access Control	Medium	2024-01-03	–	31

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.