Email address of any user can be queried on Report Invitation GraphQL type when username is known Analysed #792927 Valid Access Control High 2020-02-20 – 671 Customer private program can disclose email any users through invited via username Analysed #807448 Valid Information Disclosure High 2020-05-15 $7,500 589 An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Analysed #2032716 Valid Information Disclosure High 2023-07-04 $12,500 429 IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query Analysed #2122671 Valid Insecure Direct Object Reference High 2023-08-29 – 395 Partial disclosure of report activity through new "Export as .zip" feature Analysed #182358 Valid Information Disclosure High 2016-11-29 $10,000 355 Insecure Direct Object Reference (IDOR) - Delete Campaigns Analysed #1969141 Valid Insecure Direct Object Reference High 2023-05-03 – 346 An attacker can archive and unarchive any structured scope object on HackerOne Analysed #1501611 Valid No weakness recorded High 2022-04-18 – 318 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure High 2016-11-30 $12,500 269 Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql Analysed #3694007 Valid Command and Code Injection High 2026-06-17 $7,000 174 Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone Analysed #1727221 Valid Cross-Site Request Forgery High 2023-06-19 – 168 Slack integration setup lacks CSRF protection Analysed #170552 Valid Cross-Site Request Forgery High 2021-07-07 $2,500 149 Any user could upload attachments to pentest scoping form they don't have access to Analysed #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Internal Gitlab Ticket Disclosure via External Slack Channels Analysed #1273292 Valid Information Disclosure High 2021-08-04 – 118 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 `exportReportPdf` mutation shows internal Activity Analysed #3577216 Valid No weakness recorded High 2026-07-29 – 92 SQL Injection in CVE Discovery Search Analysed #1893800 Valid SQL Injection High 2023-03-06 – 87 Any organization's assets pending review can be downloaded Analysed #1787644 Valid Information Disclosure High 2022-11-29 – 76 Non Org Admin/Group Manager can create groups in an organization Analysed #2372018 Valid Access Control High 2024-07-23 – 68 Private program email forwarding response invitation not expire after first use. Analysed #209140 Valid Misconfiguration and Insecure Design High 2018-05-30 – 38 HackerOne Pentesters can access any structured scope object through GraphQL node interface Analysed #781150 Valid Access Control High 2020-03-11 – 30 Improperly validated fields allows injection of arbitrary HTML via spoofed React objects Analysed #49652 Valid Cross-site Scripting High 2015-03-18 $5,000 23 Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered Analysed #46072 Valid Cross-site Scripting High 2015-02-03 $5,000 21