Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Email address of any user can be queried on Report Invitation GraphQL type when username is knownAnalysed#792927	Valid	Access Control	High	2020-02-20	–	671
Customer private program can disclose email any users through invited via usernameAnalysed#807448	Valid	Information Disclosure	High	2020-05-15	$7,500	589
profile-picture name parameter with large value lead to DoS for other users and programs on the platformAnalysed#764434	Valid	Denial of Service	Medium	2020-03-25	–	475
Getting New Invitations without Leaving ProgramsAnalysed#999789	Valid	Input Validation and Logic	Low	2020-10-15	–	322
Uploading large payload on domain instructions causes server-side DoSAnalysed#887321	Valid	Denial of Service	Medium	2020-06-20	$2,500	210
An invite-only's program submission state is accessible to users no longer part of the programAnalysed#800109	Valid	Information Disclosure	Low	2020-04-21	$500	194
Race Condition leads to undeletable group memberAnalysed#604534	Valid	Race Conditions	Low	2020-03-20	–	153
Recently added 'Country' field doesn't send email notification when changedAnalysed#961841	Valid	Misconfiguration and Insecure Design	Low	2020-08-25	–	108
Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted requestAnalysed#861170	Valid	Denial of Service	Low	2020-05-25	–	97
The hacker has access to the administrative part of the management reports in publish reportAnalysed#867249	Valid	No weakness recorded	Low	2020-12-16	$500	71
Potential stored Cross-Site Scripting vulnerability in Support BackendAnalysed#858894	Valid	Cross-site Scripting	Medium	2020-05-04	–	71
Read-only team members can read all properties of webhooksAnalysed#818848	Valid	Access Control	Low	2020-04-29	–	30
A team member of the program with Report rights can ban the AdminAnalysed#816143	Valid	Input Validation and Logic	Low	2020-05-15	–	30
HackerOne Pentesters can access any structured scope object through GraphQL node interfaceAnalysed#781150	Valid	Access Control	High	2020-03-11	–	30
SAML Response Reuse on hackerone.com/users/saml/authAnalysed#888930	Valid	Authentication	Low	2020-07-24	–	26
Disabled account can still use GraphQL endpointAnalysed#608656	Valid	Access Control	Low	2020-03-12	–	24
Attacker may be able to bounce enough emails which suspend HackerOne's SES service and cause a DoS of HackerOne's email serviceAnalysed#823915	Valid	Denial of Service	Medium	2020-06-12	–	18
Changes to data in a CVE request after draft via GraphQL queryAnalysed#813300	Valid	Other weaknesses	Low	2020-05-15	–	15

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.