Email address of any user can be queried on Report Invitation GraphQL type when username is known Analysed #792927 Valid Access Control – 2020-02-20 – 671 Customer private program can disclose email any users through invited via username Analysed #807448 Valid Information Disclosure – 2020-05-15 $7,500 589 profile-picture name parameter with large value lead to DoS for other users and programs on the platform Analysed #764434 Valid Denial of Service – 2020-03-25 – 475 An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Analysed #2032716 Valid Information Disclosure High 2023-07-04 $12,500 429 IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query Analysed #2122671 Valid Insecure Direct Object Reference High 2023-08-29 – 395 IDOR allows user to access report details via reference.json endpoint Analysed #3862641 Valid Insecure Direct Object Reference Critical 2026-10-01 $15,000 372 [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick Analysed #1858574 Valid File and Path Handling Critical 2023-03-16 – 371 Hackerone is not properly deleting user id Analysed #1133118 Valid Input Validation and Logic – 2021-06-11 – 356 Partial disclosure of report activity through new "Export as .zip" feature Analysed #182358 Valid Information Disclosure – 2016-11-29 $10,000 355 Insecure Direct Object Reference (IDOR) - Delete Campaigns Analysed #1969141 Valid Insecure Direct Object Reference High 2023-05-03 – 346 Attachment disclosure via summary report Analysed #2442008 Valid Insecure Direct Object Reference Critical 2024-04-29 – 340 Getting New Invitations without Leaving Programs Analysed #999789 Valid Input Validation and Logic – 2020-10-15 – 322 An attacker can archive and unarchive any structured scope object on HackerOne Analysed #1501611 Valid No weakness recorded – 2022-04-18 – 318 Information Disclosure in /skills call Analysed #188719 Valid Information Disclosure – 2017-01-05 $10,000 287 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure – 2016-11-30 $12,500 269 Team member with Program permission only can escalate to Admin permission Analysed #605720 Valid Access Control – 2019-06-26 – 268 Race condition in performing retest allows duplicated payments Analysed #429026 Valid Race Conditions – 2018-12-27 – 240 HackerOne Jira integration plugin Leaked JWT to unauthorized jira users Analysed #1103582 Valid Authentication – 2021-04-01 $3,000 213 Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status Analysed #654198 Valid Information Disclosure – 2019-09-29 $500 213 IDOR vulnerability in unreleased HackerOne Copilot feature Analysed #2218334 Valid Insecure Direct Object Reference Medium 2023-10-25 – 210 Uploading large payload on domain instructions causes server-side DoS Analysed #887321 Valid Denial of Service – 2020-06-20 $2,500 210 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form Analysed #418767 Valid Access Control – 2018-10-31 $10,000 208 HackerOne making payments in USDC (Coinbase stable coin) Analysed #1220747 Valid No weakness recorded – 2021-06-17 – 201 An invite-only's program submission state is accessible to users no longer part of the program Analysed #800109 Valid Information Disclosure – 2020-04-21 $500 194 adding h1_analyst_* to username for normal users Analysed #1770797 Valid Input Validation and Logic Low 2023-04-12 $500 187 DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API Analysed #3287208 Valid No weakness recorded – 2026-04-16 – 185 IDOR Vulnerability at AddTagToAssets operation name Analysed #2633771 Valid Insecure Direct Object Reference Medium 2025-06-08 – 178 Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql Analysed #3694007 Valid Command and Code Injection High 2026-06-17 $7,000 174 Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone Analysed #1727221 Valid Cross-Site Request Forgery High 2023-06-19 – 168 Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint Analysed #536853 Valid Insecure Direct Object Reference – 2019-04-23 – 161 LLM01: Invisible Prompt Injection Analysed #2372363 Valid Injection and Smuggling Medium 2024-05-13 – 159 IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier Analysed #449351 Valid Cross-site Scripting – 2018-11-27 $2,500 156 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155 Race Condition leads to undeletable group member Analysed #604534 Valid Race Conditions – 2020-03-20 – 153 Banned user still has access to their deleted account via HackerOne's API using their API key Analysed #1577940 Valid Access Control Medium 2025-07-14 – 150 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid Access Control Low 2024-06-06 – 149 Slack integration setup lacks CSRF protection Analysed #170552 Valid Cross-Site Request Forgery – 2021-07-07 $2,500 149 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure – 2019-04-24 $3,000 147 Stored XSS in IE11 on hackerone.com via custom fields Analysed #1173040 Valid Cross-site Scripting – 2021-06-24 – 146 Server Side Request Forgery (SSRF) in webhook functionality Analysed #2301565 Valid Server-Side Request Forgery Medium 2024-01-30 $2,500 140 Disclose any user's private email through API Analysed #196655 Valid Information Disclosure – 2017-02-24 – 140 Banned researcher gets email updates on a private program. Analysed #271506 Valid No weakness recorded – 2019-05-18 – 139 Payload delivery via Social Media urls on H1 profile Analysed #2483422 Valid File and Path Handling Medium 2024-07-23 – 138 Subdomain takeover at info.hacker.one Analysed #202767 Valid Access Control – 2017-03-27 – 134 Disclosure handle private program with external link Analysed #1276992 Valid No weakness recorded – 2021-08-24 $2,500 130 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure – 2019-11-08 – 127 Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse Analysed #3378540 Valid Access Control Low 2026-03-18 – 126 Race Conditions in Popular reports feature. Analysed #146845 Valid Memory Corruption – 2016-08-03 – 125 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124