Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| DoS attack via comment on IssueAnalysed#557154 | Valid | Denial of Service | Low | 2019-11-21 | $1,000 | 84 |
| Subdomain takeover in Gitlab pagesAnalysed#2523654 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-09 | – | 79 |
| HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressAnalysed#1935628 | Valid | Injection and Smuggling | Low | 2024-10-08 | $1,060 | 61 |
| Know whether private project name exists or not within a group using link commentsAnalysed#495497 | Valid | Information Disclosure | Low | 2019-10-07 | – | 58 |
| EXIF metadata not stripped from JPG group logosAnalysed#446238 | Valid | Information Disclosure | Low | 2020-09-08 | $500 | 55 |
| All functions that allow users to specify color code are vulnerable to ReDoSAnalysed#511381 | Valid | Denial of Service | Low | 2019-08-21 | $1,000 | 53 |
| Clientside resource Exhausting by exploiting gitlab math renderingAnalysed#549040 | Valid | Denial of Service | Low | 2019-10-01 | – | 50 |
| View the Starred Projects in a Private ProfileAnalysed#703894 | Valid | Insecure Direct Object Reference | Low | 2021-02-02 | $500 | 49 |
| Milestones leaked via search APIAnalysed#460815 | Valid | Access Control | Low | 2019-07-19 | – | 43 |
| Privilege escalation due to insecure use of logrotateAnalysed#578119 | Valid | Access Control | Low | 2019-10-01 | – | 32 |
| Guest Users can create issues for Sentry errors and track their statusAnalysed#1117768 | Valid | Access Control | Low | 2021-09-24 | $610 | 29 |
| Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR)Analysed#439729 | Valid | Insecure Direct Object Reference | Low | 2019-09-19 | – | 27 |
| Domain Takeover - gl-canary.freetls.fastly.netAnalysed#716677 | Valid | Access Control | Low | 2023-05-30 | $200 | 25 |
| Persistent XSS via e-mail when creating merge requestsAnalysed#496973 | Valid | Cross-site Scripting | Low | 2019-08-30 | – | 24 |
| Possibilty to purchase Ultimate - 1 Year (EDU or OSS)Analysed#882848 | Valid | Input Validation and Logic | Low | 2020-11-02 | – | 23 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.