Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") eventsAnalysed#174404	Valid	Information Disclosure	Medium	2021-05-14	–	91
Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balanceAnalysed#574638	Valid	Input Validation and Logic	Medium	2019-07-18	–	82
Unrestricted File Upload Results in Cross-Site Scripting AttacksAnalysed#1005355	Valid	Cross-site Scripting	Medium	2021-05-14	–	58
Change the rating of any trip, therefore change the average driver ratingAnalysed#724522	Valid	Input Validation and Logic	Medium	2020-04-06	$1,500	43
Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employeesAnalysed#1063022	Valid	Access Control	Medium	2021-05-14	–	29
Possibility to enumerate and bruteforce promotion codes in Uber iOS AppAnalysed#125707	Valid	Authentication	Medium	2018-11-20	$3,000	24
pam-ussh may be tricked into using another logged in user's ssh-agentAnalysed#204802	Valid	Authentication	Medium	2017-03-20	–	23
IDOR on partners.uber.com allows for a driver to override administrator documentsAnalysed#194594	Valid	Insecure Direct Object Reference	Medium	2018-12-19	–	23

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.