Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)Analysed#391092	Valid	Insecure Direct Object Reference	Critical	2020-08-19	–	214
CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit CardAnalysed#358143	Valid	Information Disclosure	High	2020-08-19	–	87
Yelp for Business: locked Email field silently editable via APIAnalysed#3766455	Valid	Input Validation and Logic	Medium	2026-07-02	–	76
Privilege Escalation - A Non Owner User Who Does not Have access to the user management can invite other users to the restaurant pageAnalysed#2396549	Valid	Access Control	Low	2025-01-29	–	75
Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business accountAnalysed#2396571	Valid	Access Control	Low	2025-01-28	–	60
Debug Deep Link Abuse Allows Repeated Forced Logout and Application DisruptionAnalysed#3829030	Valid	Misconfiguration and Insecure Design	Low	2026-08-13	–	54
Bybass The Closing of the account and logged again to your accountAnalysed#167489	Valid	Authentication	–	2016-10-21	–	34

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.