Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSP-bypass XSS in project settings pageAnalysed#1588732 | Valid | Cross-site Scripting | High | 2022-11-16 | – | 100 |
| Group search with Elastic search enable leaks unrelated dataAnalysed#708820 | Valid | Access Control | High | 2019-12-14 | – | 100 |
| Account takeover due to insufficient URL validation on RelayState parameterAnalysed#1923672 | Valid | Cross-Site Request Forgery | Medium | 2023-05-30 | $2,450 | 99 |
| Bypass: Stored-XSS with CSP-bypass via scoped labels' colorAnalysed#1693150 | Valid | Cross-site Scripting | High | 2023-02-19 | – | 96 |
| XSS in request approvalsAnalysed#402658 | Valid | Cross-site Scripting | Medium | 2021-04-23 | $3,000 | 96 |
| New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fieldsAnalysed#1578400 | Valid | Cross-site Scripting | High | 2022-11-16 | $13,950 | 93 |
| Unrestricted file upload leads to Stored XSSAnalysed#880099 | Valid | Cross-site Scripting | Medium | 2020-08-03 | – | 90 |
| RepositoryPipeline allows importing of local git reposAnalysed#1685822 | Valid | Access Control | Medium | 2022-11-04 | $22,300 | 89 |
| Stored XSS in "Create Groups"Analysed#647130 | Valid | Cross-site Scripting | High | 2020-08-26 | $2,500 | 89 |
| CSRF on /api/graphql allows executing mutations through GET requestsAnalysed#1122408 | Valid | Cross-Site Request Forgery | High | 2021-08-02 | $3,370 | 88 |
| Path traversal in Nuget Package RegistryAnalysed#822262 | Valid | File and Path Handling | High | 2022-06-07 | $12,000 | 88 |
| DoS attack via comment on IssueAnalysed#557154 | Valid | Denial of Service | Low | 2019-11-21 | $1,000 | 84 |
| Cache poisoning Denial of Service affecting assets.gitlab-static.netAnalysed#1160407 | Valid | Denial of Service | High | 2021-12-22 | – | 83 |
| XSS in ZenTao integration affecting self hosted instances without strict CSPAnalysed#1542510 | Valid | Cross-site Scripting | High | 2022-09-22 | – | 81 |
| Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"Analysed#1256777 | Valid | Cross-site Scripting | High | 2021-09-15 | – | 80 |
| Subdomain takeover in Gitlab pagesAnalysed#2523654 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-09 | – | 79 |
| GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command InjectionAnalysed#955016 | Valid | Command and Code Injection | High | 2020-11-04 | – | 77 |
| Remove obsolete domain from handbook subdomainAnalysed#2599840 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-01 | – | 72 |
| GitLab::UrlBlocker validation bypass leading to full Server Side Request ForgeryAnalysed#541169 | Valid | Server-Side Request Forgery | High | 2019-12-12 | – | 72 |
| SSRF in CI after first runAnalysed#369451 | Valid | Server-Side Request Forgery | Medium | 2019-04-12 | – | 72 |
| Stored-XSS injected in Wiki page via Banzai pipelineAnalysed#2257080 | Valid | Cross-site Scripting | High | 2024-05-28 | – | 71 |
| Privilege escalation of "external user" (with maintainer privilege) to internal access through project tokenAnalysed#1193062 | Valid | Access Control | Medium | 2021-10-11 | – | 66 |
| DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverAnalysed#2499070 | Valid | Denial of Service | Medium | 2024-10-09 | $2,300 | 64 |
| GraphQL query "namespace" leaks dataAnalysed#614355 | Valid | Access Control | Medium | 2019-12-03 | – | 64 |
| HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressAnalysed#1935628 | Valid | Injection and Smuggling | Low | 2024-10-08 | $1,060 | 61 |
| Ability to access all user authentication tokens, leads to RCEAnalysed#158330 | Valid | Access Control | Critical | 2016-11-03 | – | 61 |
| [Admin Panel] CSRF to resume/pause runnerAnalysed#415238 | Valid | Cross-Site Request Forgery | Low | 2020-12-01 | – | 60 |
| Stored-XSS on wiki pagesAnalysed#1087061 | Valid | Cross-site Scripting | Medium | 2021-07-13 | – | 59 |
| Stored XSS via Mermaid Prototype Pollution vulnerabilityAnalysed#1106238 | Valid | Cross-site Scripting | High | 2021-07-12 | $3,000 | 58 |
| FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.comAnalysed#1092230 | Valid | Server-Side Request Forgery | High | 2021-07-13 | – | 58 |
| Know whether private project name exists or not within a group using link commentsAnalysed#495497 | Valid | Information Disclosure | Low | 2019-10-07 | – | 58 |
| Content injection in Jira issue title enabling sending arbitrary POST request as victimAnalysed#1533976 | Valid | Injection and Smuggling | High | 2022-09-22 | – | 55 |
| Bypass Email Verification using Salesforce -- Reproducible in gitlab.comAnalysed#617896 | Valid | Misconfiguration and Insecure Design | High | 2019-12-13 | – | 55 |
| EXIF metadata not stripped from JPG group logosAnalysed#446238 | Valid | Information Disclosure | Low | 2020-09-08 | $500 | 55 |
| Arbitrary POST request as victim user from HTML injection in Jupyter notebooksAnalysed#1409788 | Valid | Injection and Smuggling | High | 2022-05-20 | – | 54 |
| Access to GitLab's Slack by abusing issue creation from e-mailAnalysed#218230 | Valid | Authentication | Critical | 2017-09-21 | – | 54 |
| Stored XSS in merge request pagesAnalysed#723307 | Valid | Cross-site Scripting | High | 2023-05-30 | $3,500 | 53 |
| All functions that allow users to specify color code are vulnerable to ReDoSAnalysed#511381 | Valid | Denial of Service | Low | 2019-08-21 | $1,000 | 53 |
| Change project visibility to a restricted optionAnalysed#1086781 | Valid | Misconfiguration and Insecure Design | Medium | 2021-12-30 | $1,370 | 51 |
| RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installedAnalysed#1401444 | Valid | Command and Code Injection | – | 2022-04-12 | $3,000 | 50 |
| Stored XSS on the job pageAnalysed#856554 | Valid | Cross-site Scripting | High | 2021-01-08 | $3,000 | 50 |
| Stored XSS in markdown when redacting referencesAnalysed#836649 | Valid | Cross-site Scripting | High | 2020-09-09 | $5,000 | 50 |
| Clientside resource Exhausting by exploiting gitlab math renderingAnalysed#549040 | Valid | Denial of Service | Low | 2019-10-01 | – | 50 |
| Command injection by overwriting authorized_keys file through GitLab importAnalysed#298873 | Valid | Command and Code Injection | Critical | 2018-04-27 | $2,000 | 50 |
| Improper access control for users with expired password, giving the user full access through API and GitAnalysed#1285226 | Valid | Access Control | Medium | 2022-01-27 | – | 49 |
| Guest users can create new test casesAnalysed#1113289 | Valid | Access Control | Medium | 2021-08-30 | $650 | 49 |
| XSS on Issue reference numbersAnalysed#831962 | Valid | Cross-site Scripting | Medium | 2020-11-23 | – | 49 |
| View the Starred Projects in a Private ProfileAnalysed#703894 | Valid | Insecure Direct Object Reference | Low | 2021-02-02 | $500 | 49 |
| Stored XSS via Mermaid Prototype Pollution vulnerabilityAnalysed#1280002 | Valid | Cross-site Scripting | High | 2021-11-18 | $3,000 | 48 |
| A deactivated user can access data through GraphQLAnalysed#1192460 | Valid | Access Control | Medium | 2021-08-30 | – | 47 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.