Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Webshell via File Upload on ecjobs.starbucks.com.cnAnalysed#506646 | Valid | Command and Code Injection | Critical | 2019-11-13 | – | 688 |
| XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspxAnalysed#500515 | Valid | Injection and Smuggling | Critical | 2019-11-13 | – | 319 |
| Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataAnalysed#876295 | Valid | File and Path Handling | Critical | 2020-06-16 | – | 239 |
| Parameter Manipulation allowed for viewing of other user’s teavana.com ordersAnalysed#141090 | Valid | Authentication | – | 2017-01-13 | – | 71 |
| Thailand - Insecure Direct Object Reference permits an unauthorized user to transfer funds from a victim using only the victims Starbucks cardAnalysed#766437 | Valid | Insecure Direct Object Reference | High | 2020-02-11 | – | 36 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.