Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Rate-limit bypassAnalysed#165727	Valid	Authentication	–	2016-11-28	$500	27
HTTP parameter pollution from outdated Greenhouse.io JS dependencyAnalysed#335339	Valid	Injection and Smuggling	Medium	2018-07-19	–	26
Source code leakage through GIT web access at host '52.91.137.42'Analysed#148068	Valid	Authentication	–	2016-08-15	–	26
Misuse of groups feature allows workspace members to join private channels without being invitedAnalysed#1248852	Valid	Access Control	High	2021-10-21	–	23
[Screenhero] Subdomain takeoverAnalysed#142096	Valid	Misconfiguration and Insecure Design	–	2017-01-21	–	23
CSRF in github integrationAnalysed#174328	Valid	Cross-Site Request Forgery	Medium	2016-11-18	$500	22
Stored XSS in files.slack.com#827606	Valid	Cross-site Scripting	Medium	2021-12-02	–	19
Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authentication#238260	Valid	Authentication	Low	2020-11-10	$500	18
Facebook Takeover using Slack using 302 from files.slack.com with access_token#6017	Valid	Open Redirect	–	2015-01-11	–	17
Invitation reminder emails contain insecure links#327674	Valid	Cryptography	Low	2019-06-29	$350	15
Bypass to postMessage origin validation via FTP#210654	Valid	Cross-site Scripting	High	2017-04-21	–	15
Information Disclosure on stun.screenhero.com#175061	Valid	Information Disclosure	Medium	2016-11-30	$700	14
Code Injection in Slack's Windows Desktop Client leads to Privilege Escalation#162955	Valid	Command and Code Injection	–	2017-07-14	–	14
Bypass of the SSRF protection (Slack commands, Phabricator integration)#61312	Valid	No weakness recorded	–	2016-09-14	$100	14
Cross-site leak allows attacker to de-anonymize members of his team from another origin#1068153	Valid	Access Control	Low	2021-11-11	$250	13
HTML Injection inside Slack promotional emails#321029	Valid	No weakness recorded	Low	2018-07-30	$100	13
Shared-channel BETA persists integration after unshare#291822	Valid	Input Validation and Logic	Medium	2018-04-25	$750	13
dom xss in https://www.slackatwork.com#196624	Valid	Cross-site Scripting	Low	2017-03-02	–	13
Open Redirect on slack.com#140447	Valid	Cross-site Scripting	–	2016-10-02	$500	12
CSV export/import functionality allows administrators to modify member and message content of a workspace#1661310	Informative	Access Control	None	2022-09-28	$250	11
Open redirect vulnerability#2731	Informative	Open Redirect	–	2014-04-06	–	11
Relative Path Vulnerability Results in Arbitrary Command Execution/Privilege Escalation#784714	Valid	Command and Code Injection	Medium	2020-04-01	$750	10
Creating Post on a restricted channel#151459	Valid	Access Control	–	2016-09-29	–	10
User can start call in a channel of an unpaid account#147369	Valid	Access Control	–	2016-09-15	$100	10
Authentication bypass leads to sensitive data exposure (token+secret)#129918	Valid	Authentication	–	2016-10-19	$2,000	10
Slack OAuth2 "redirect_uri" Bypass#2575	Valid	Authentication	–	2014-05-29	–	10
Possibility to freeze/crash the host system of all Slack Desktop users easily#392728	Valid	Misconfiguration and Insecure Design	Low	2020-11-10	–	9
a stored xss issue in https://files.slack.com#149011	Valid	Cross-site Scripting	–	2017-06-25	$500	9
Stored XSS Found#9774	Valid	Cross-site Scripting	–	2014-06-01	–	9
Data exports stored on S3 can be scraped easily#2746	Valid	Authentication	–	2014-12-09	–	9
"a stored xss issue in share post menu"#148848	Valid	Cross-site Scripting	–	2017-06-25	$500	8
Open Redirect login account#16718	Valid	Open Redirect	–	2014-08-25	$100	8
Stored XSS in Slackbot Direct Messages#4561	Valid	Cross-site Scripting	–	2014-05-04	–	8
Email enumeration#2766	Informative	Information Disclosure	–	2014-04-02	–	8
Stored XSS in www.slack-files.com#2617	Valid	Cross-site Scripting	–	2014-05-23	–	8
Broken Authentication (including Slack OAuth bugs)#2559	Valid	Misconfiguration and Insecure Design	–	2014-08-30	–	8
CSRF - Add optional two factor mobile number#155774	Valid	Cross-Site Request Forgery	–	2016-08-17	$500	7
Remote file Inclusion - RFI in upload#14092	Informative	Command and Code Injection	–	2014-07-08	–	7
Session Fixation disclosing email address#2582	Informative	Information Disclosure	–	2014-03-31	–	7
RC4 cipher suites detected on status.slack.com#99157	Valid	Misconfiguration and Insecure Design	–	2016-11-18	–	6
a stored xss in slack integration https://onerror.slack.com/services/import#33018	Valid	Cross-site Scripting	–	2016-05-22	$500	6
State parameter missing on google OAuth#2688	Valid	Cross-Site Request Forgery	–	2014-04-06	–	6
Stored XSS on this link https://sehacure.slack.com/help/requests/#2639	Valid	Cross-site Scripting	–	2014-08-30	–	6
Email information leakage for certain addresses#169992	Valid	Information Disclosure	–	2016-10-31	$400	5
Generate new Test token#147544	Valid	Authentication	–	2016-09-15	$100	5
File upload over private IM channel#143903	Valid	Access Control	–	2016-07-13	–	5
Password Policy issue (Weak Protect)#17160	Valid	Misconfiguration and Insecure Design	–	2014-09-04	–	5
SSRF on https://whitehataudit.slack.com/account/photo#14127	Valid	Command and Code Injection	–	2014-12-21	–	5
Stored XSS in Slack.com#6002	Valid	Cross-site Scripting	–	2015-03-09	–	5
CSRF vulnerability on https://sehacure.slack.com/account/settings#2628	Valid	Cross-Site Request Forgery	–	2014-07-26	–	5

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.