Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting57
- Cross-Site Request Forgery6
- Open Redirect5
- Server-Side Request Forgery18
- SQL Injection1
- Command and Code Injection18
- Injection and Smuggling4
- File and Path Handling5
- Memory Corruption1
- Denial of Service14
- Input Validation and Logic7
- Misconfiguration and Insecure Design15
- Information Disclosure32
- Authentication9
- Access Control52
- Insecure Direct Object Reference12
- No weakness recorded1
Access (title)Any
Access (analysis)Any
TechniqueAny
- Any
- Information disclosure6
- Path traversal6
- Missing authorisation check5
- Business logic flaw4
- OS command injection4
- SSRF4
- Authentication bypass3
- IDOR / object reference3
- Privilege escalation3
- Stored XSS3
- Account takeover chain2
- Code injection / eval2
- E-mail verification bypass2
- HTML injection2
- Leaked secret or key2
- Unsafe file upload2
- CSP bypass1
- Local file inclusion1
- Mass assignment1
- Parameter pollution1
- Password reset flaw1
- Session fixation or reuse1
- SSRF through a redirect1
- Unsafe deserialisation1
257 of 15,219 reports · $594,110 in bounties · 227 analysed so far
- #1588732ValidCSP-bypass XSS in project settings pageGitLab · Cross-site Scripting · 2022–100votes
- #708820ValidGroup search with Elastic search enable leaks unrelated dataGitLab · Access Control · 2019–100votes
- #1923672ValidAccount takeover due to insufficient URL validation on RelayState parameterGitLab · Cross-Site Request Forgery · 2023$2,45099votes
- #1693150ValidBypass: Stored-XSS with CSP-bypass via scoped labels' colorGitLab · Cross-site Scripting · 2023–96votes
- #402658ValidXSS in request approvalsGitLab · Cross-site Scripting · 2021$3,00096votes
- #1578400ValidNew /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fieldsGitLab · Cross-site Scripting · 2022$13,95093votes
- #880099ValidUnrestricted file upload leads to Stored XSSGitLab · Cross-site Scripting · 2020–90votes
- #1685822ValidRepositoryPipeline allows importing of local git reposGitLab · Access Control · 2022$22,30089votes
- #647130ValidStored XSS in "Create Groups"GitLab · Cross-site Scripting · 2020$2,50089votes
- #1122408ValidCSRF on /api/graphql allows executing mutations through GET requestsGitLab · Cross-Site Request Forgery · 2021$3,37088votes
- #822262ValidPath traversal in Nuget Package RegistryGitLab · File and Path Handling · 2022$12,00088votes
- #557154ValidDoS attack via comment on IssueGitLab · Denial of Service · 2019$1,00084votes
- #1160407ValidCache poisoning Denial of Service affecting assets.gitlab-static.netGitLab · Denial of Service · 2021–83votes
- #1542510ValidXSS in ZenTao integration affecting self hosted instances without strict CSPGitLab · Cross-site Scripting · 2022–81votes
- #1256777ValidStored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"GitLab · Cross-site Scripting · 2021–80votes
- #2523654ValidSubdomain takeover in Gitlab pagesGitLab · Misconfiguration and Insecure Design · 2024 · Low–79votes
- #955016ValidGitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command InjectionGitLab · Command and Code Injection · 2020–77votes
- #2599840ValidRemove obsolete domain from handbook subdomainGitLab · Misconfiguration and Insecure Design · 2024 · Low–72votes
- #541169ValidGitLab::UrlBlocker validation bypass leading to full Server Side Request ForgeryGitLab · Server-Side Request Forgery · 2019–72votes
- #369451ValidSSRF in CI after first runGitLab · Server-Side Request Forgery · 2019–72votes
- #2257080ValidStored-XSS injected in Wiki page via Banzai pipelineGitLab · Cross-site Scripting · 2024 · High–71votes
- #2676025InformativeLogin email verification bypass via `/oauth/token`.GitLab · Authentication · 2024 · None–66votes
- #1193062ValidPrivilege escalation of "external user" (with maintainer privilege) to internal access through project tokenGitLab · Access Control · 2021–66votes
- #2499070ValidDOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverGitLab · Denial of Service · 2024 · Medium$2,30064votes
- #614355ValidGraphQL query "namespace" leaks dataGitLab · Access Control · 2019–64votes
- #1935628ValidHTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressGitLab · Injection and Smuggling · 2024 · Low$1,06061votes
- #158330ValidAbility to access all user authentication tokens, leads to RCEGitLab · Access Control · 2016–61votes
- #415238Valid[Admin Panel] CSRF to resume/pause runnerGitLab · Cross-Site Request Forgery · 2020–60votes
- #1087061ValidStored-XSS on wiki pagesGitLab · Cross-site Scripting · 2021–59votes
- #1106238ValidStored XSS via Mermaid Prototype Pollution vulnerabilityGitLab · Cross-site Scripting · 2021$3,00058votes
- #1092230ValidFogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.comGitLab · Server-Side Request Forgery · 2021–58votes
- #495497ValidKnow whether private project name exists or not within a group using link commentsGitLab · Information Disclosure · 2019–58votes
- #1533976ValidContent injection in Jira issue title enabling sending arbitrary POST request as victimGitLab · Injection and Smuggling · 2022–55votes
- #617896ValidBypass Email Verification using Salesforce -- Reproducible in gitlab.comGitLab · Misconfiguration and Insecure Design · 2019–55votes
- #446238ValidEXIF metadata not stripped from JPG group logosGitLab · Information Disclosure · 2020$50055votes
- #1409788ValidArbitrary POST request as victim user from HTML injection in Jupyter notebooksGitLab · Injection and Smuggling · 2022–54votes
- #218230ValidAccess to GitLab's Slack by abusing issue creation from e-mailGitLab · Authentication · 2017–54votes
- #723307ValidStored XSS in merge request pagesGitLab · Cross-site Scripting · 2023$3,50053votes
- #511381ValidAll functions that allow users to specify color code are vulnerable to ReDoSGitLab · Denial of Service · 2019$1,00053votes
- #1086781ValidChange project visibility to a restricted optionGitLab · Misconfiguration and Insecure Design · 2021$1,37051votes
- #1401444ValidRCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installedGitLab · Command and Code Injection · 2022$3,00050votes
- #856554ValidStored XSS on the job pageGitLab · Cross-site Scripting · 2021$3,00050votes
- #836649ValidStored XSS in markdown when redacting referencesGitLab · Cross-site Scripting · 2020$5,00050votes
- #549040ValidClientside resource Exhausting by exploiting gitlab math renderingGitLab · Denial of Service · 2019–50votes
- #298873ValidCommand injection by overwriting authorized_keys file through GitLab importGitLab · Command and Code Injection · 2018$2,00050votes
- #1285226ValidImproper access control for users with expired password, giving the user full access through API and GitGitLab · Access Control · 2022–49votes
- #1113289ValidGuest users can create new test casesGitLab · Access Control · 2021 · a user account (title)$65049votes
- #831962ValidXSS on Issue reference numbersGitLab · Cross-site Scripting · 2020–49votes
- #703894ValidView the Starred Projects in a Private ProfileGitLab · Insecure Direct Object Reference · 2021$50049votes
- #1280002ValidStored XSS via Mermaid Prototype Pollution vulnerabilityGitLab · Cross-site Scripting · 2021$3,00048votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.