Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainAnalysed#565883 | Valid | Input Validation and Logic | Medium | 2019-08-30 | – | 249 |
| DoS on the Issue page by exploiting Mermaid.Analysed#470067 | Valid | Denial of Service | Medium | 2019-05-13 | $3,000 | 145 |
| Send arbitrary PUT requests when user clicks on a linkAnalysed#824689 | Valid | Command and Code Injection | Medium | 2020-07-27 | – | 135 |
| IDOR Exposes All Machine Learning ModelsAnalysed#2528293 | Valid | Insecure Direct Object Reference | Medium | 2024-10-01 | $1,160 | 117 |
| Account takeover due to insufficient URL validation on RelayState parameterAnalysed#1923672 | Valid | Cross-Site Request Forgery | Medium | 2023-05-30 | $2,450 | 99 |
| XSS in request approvalsAnalysed#402658 | Valid | Cross-site Scripting | Medium | 2021-04-23 | $3,000 | 96 |
| Unrestricted file upload leads to Stored XSSAnalysed#880099 | Valid | Cross-site Scripting | Medium | 2020-08-03 | – | 90 |
| RepositoryPipeline allows importing of local git reposAnalysed#1685822 | Valid | Access Control | Medium | 2022-11-04 | $22,300 | 89 |
| SSRF in CI after first runAnalysed#369451 | Valid | Server-Side Request Forgery | Medium | 2019-04-12 | – | 72 |
| Privilege escalation of "external user" (with maintainer privilege) to internal access through project tokenAnalysed#1193062 | Valid | Access Control | Medium | 2021-10-11 | – | 66 |
| DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverAnalysed#2499070 | Valid | Denial of Service | Medium | 2024-10-09 | $2,300 | 64 |
| Stored-XSS on wiki pagesAnalysed#1087061 | Valid | Cross-site Scripting | Medium | 2021-07-13 | – | 59 |
| Change project visibility to a restricted optionAnalysed#1086781 | Valid | Misconfiguration and Insecure Design | Medium | 2021-12-30 | $1,370 | 51 |
| Improper access control for users with expired password, giving the user full access through API and GitAnalysed#1285226 | Valid | Access Control | Medium | 2022-01-27 | – | 49 |
| Guest users can create new test casesAnalysed#1113289 | Valid | Access Control | Medium | 2021-08-30 | $650 | 49 |
| XSS on Issue reference numbersAnalysed#831962 | Valid | Cross-site Scripting | Medium | 2020-11-23 | – | 49 |
| A deactivated user can access data through GraphQLAnalysed#1192460 | Valid | Access Control | Medium | 2021-08-30 | – | 47 |
| When you call your branch the same name as a git hash, it could be checked out by dependentsAnalysed#790634 | Valid | Injection and Smuggling | Medium | 2021-08-19 | $2,000 | 39 |
| Stored XSS in blob viewerAnalysed#806571 | Valid | Cross-site Scripting | Medium | 2020-08-04 | – | 37 |
| IDOR in "external status check" API leaks data about any status check on the instanceAnalysed#1372216 | Valid | Insecure Direct Object Reference | Medium | 2022-02-22 | – | 35 |
| Clipboard DOM-based XSSAnalysed#1196958 | Valid | Cross-site Scripting | Medium | 2021-08-19 | – | 35 |
| Uncontrolled Resource Consumption in any Markdown field using MermaidAnalysed#670572 | Valid | Denial of Service | Medium | 2019-12-20 | – | 31 |
| GitLab's GitHub integration is vulnerable to SSRF vulnerabilityAnalysed#446593 | Valid | Server-Side Request Forgery | Medium | 2019-08-30 | $2,000 | 30 |
| Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippetAnalysed#1751258 | Valid | Insecure Direct Object Reference | Medium | 2023-06-02 | $1,730 | 29 |
| Able to leak private email of any user given his/her username via graphqlAnalysed#972355 | Valid | Information Disclosure | Medium | 2021-01-08 | – | 29 |
| Stored XSS in group issue listAnalysed#859333 | Valid | Cross-site Scripting | Medium | 2020-11-21 | $2,000 | 27 |
| Stored XSS on PyPi simple API endpointAnalysed#856836 | Valid | Cross-site Scripting | Medium | 2020-09-09 | $3,000 | 25 |
| Unauthorized access to private project security dashboardAnalysed#853355 | Valid | Information Disclosure | Medium | 2020-11-21 | – | 24 |
| Unauthorized users may be able to view almost all informations related to Private projects.Analysed#407763 | Valid | Information Disclosure | Medium | 2018-12-03 | – | 24 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.