profile-picture name parameter with large value lead to DoS for other users and programs on the platform Analysed #764434 Valid Denial of Service Medium 2020-03-25 – 475 Hackerone is not properly deleting user id Analysed #1133118 Valid Input Validation and Logic Medium 2021-06-11 – 356 Information Disclosure in /skills call Analysed #188719 Valid Information Disclosure Medium 2017-01-05 $10,000 287 Team member with Program permission only can escalate to Admin permission Analysed #605720 Valid Access Control Medium 2019-06-26 – 268 Race condition in performing retest allows duplicated payments Analysed #429026 Valid Race Conditions Medium 2018-12-27 – 240 HackerOne Jira integration plugin Leaked JWT to unauthorized jira users Analysed #1103582 Valid Authentication Medium 2021-04-01 $3,000 213 IDOR vulnerability in unreleased HackerOne Copilot feature Analysed #2218334 Valid Insecure Direct Object Reference Medium 2023-10-25 – 210 Uploading large payload on domain instructions causes server-side DoS Analysed #887321 Valid Denial of Service Medium 2020-06-20 $2,500 210 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form Analysed #418767 Valid Access Control Medium 2018-10-31 $10,000 208 IDOR Vulnerability at AddTagToAssets operation name Analysed #2633771 Valid Insecure Direct Object Reference Medium 2025-06-08 – 178 LLM01: Invisible Prompt Injection Analysed #2372363 Valid Injection and Smuggling Medium 2024-05-13 – 159 IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier Analysed #449351 Valid Cross-site Scripting Medium 2018-11-27 $2,500 156 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155 Banned user still has access to their deleted account via HackerOne's API using their API key Analysed #1577940 Valid Access Control Medium 2025-07-14 – 150 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure Medium 2019-04-24 $3,000 147 Stored XSS in IE11 on hackerone.com via custom fields Analysed #1173040 Valid Cross-site Scripting Medium 2021-06-24 – 146 Server Side Request Forgery (SSRF) in webhook functionality Analysed #2301565 Valid Server-Side Request Forgery Medium 2024-01-30 $2,500 140 Disclose any user's private email through API Analysed #196655 Valid Information Disclosure Medium 2017-02-24 – 140 Payload delivery via Social Media urls on H1 profile Analysed #2483422 Valid File and Path Handling Medium 2024-07-23 – 138 Disclosure handle private program with external link Analysed #1276992 Valid No weakness recorded Medium 2021-08-24 $2,500 130 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure Medium 2019-11-08 – 127 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████ Analysed #1285115 Valid Information Disclosure Medium 2021-11-08 – 118 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. Analysed #397792 Valid Input Validation and Logic Medium 2019-01-02 – 117 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages Analysed #713407 Valid Denial of Service Medium 2019-12-13 – 111 Banned user still able to invited to reports as a collabrator and reset the password Analysed #1959219 Valid Access Control Medium 2023-07-06 – 107 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature Analysed #334205 Valid Input Validation and Logic Medium 2018-04-18 $2,500 103 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 Reading redacted data via hackbot's answers Analysed #247628 Valid Information Disclosure Medium 2017-07-27 $1,500 93 Bypass report submit restriction/ban using the API key Analysed #2081930 Valid Access Control Medium 2023-10-29 – 91 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control Medium 2018-12-05 $2,500 90 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86 Some limited confidential information can still be accessed after a user exits a private program Analysed #2278865 Valid Information Disclosure Medium 2024-01-19 $50 86 Triager/Team members can edit hacker's report and hacker is not even notified Analysed #2061367 Valid No weakness recorded Medium 2023-08-31 $2,500 84 Draft report exposure via slack alerting system for programs Analysed #2069593 Valid Information Disclosure Medium 2023-10-06 – 83 Possible PII Disclosure via Advanced Vetting Process - ██████ Analysed #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 Private information exposed through GraphQL filters Analysed #645299 Valid Information Disclosure Medium 2019-07-23 – 81 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" Analysed #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 inviting collaborator using email disclose the hackerone account related to the user Analysed #2045722 Valid Information Disclosure Medium 2024-09-19 – 80 Asset Inventory Internal Descriptions are leaked in CSV export Analysed #2011431 Valid Input Validation and Logic Medium 2023-07-12 – 76 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid Insecure Direct Object Reference Medium 2019-10-25 – 76 Validation message in Bounty award endpoint can be used to determine program balances Analysed #293299 Valid Information Disclosure Medium 2017-11-29 – 73 Potential stored Cross-Site Scripting vulnerability in Support Backend Analysed #858894 Valid Cross-site Scripting Medium 2020-05-04 – 71 Private draft report exposure in a program a user is added as a viewer to Analysed #2552205 Valid Information Disclosure Medium 2024-09-17 $2,500 66 Any user with access to program can resume and suspend HackerOne Gateway Analysed #717716 Valid Insecure Direct Object Reference Medium 2019-10-21 – 65 "package_name" can be set as desired when submitting a Pentest Opportunity form Analysed #2431495 Valid Access Control Medium 2024-06-19 – 63 Report Private Links Leaks to Google Analytics via Query String Param Analysed #269479 Valid Information Disclosure Medium 2017-10-25 – 59 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid Access Control Medium 2023-11-22 – 57 Changing the 2FA secret key and backup codes without knowing the 2FA OTP Analysed #1139535 Valid Other weaknesses Medium 2021-05-06 – 57