Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable AI)Analysed#3371448	Valid	Access Control	Low	2025-11-04	–	79
Business Logic Bypass Allows Setting “Read Access” Role Without Pro Plan SubscriptionAnalysed#3591764	Valid	Input Validation and Logic	Medium	2026-03-16	–	78
Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameterAnalysed#3599248	Valid	Open Redirect	Medium	2026-03-12	–	74
Users can change project visibility which requires high subscription by just changing request bodyAnalysed#3370430	Valid	Access Control	Medium	2026-03-09	–	71
Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable Cloud)Analysed#3371414	Valid	Access Control	Low	2025-11-04	–	66
Low-privileged user can enable or disable Lovable AI for new projects in workspaceAnalysed#3369843	Valid	Access Control	Low	2025-11-07	–	56
Open Redirect on lovable.dev via redirect parameter leads to phishing attacksAnalysed#3581815	Valid	No weakness recorded	–	2026-03-05	–	44

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.