Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages Analysed #713407 Valid Denial of Service – 2019-12-13 – 111 [IDOR] Improper Access Control on Embedded Submission Form Analysed #2483666 Valid Insecure Direct Object Reference Low 2024-06-19 $2,500 110 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 Recently added 'Country' field doesn't send email notification when changed Analysed #961841 Valid Misconfiguration and Insecure Design Low 2020-08-25 – 108 Banned user still able to invited to reports as a collabrator and reset the password Analysed #1959219 Valid Access Control Medium 2023-07-06 – 107 GraphQL field on Team node can be used to determine if External Program runs invite-only program Analysed #877642 Valid Information Disclosure Medium 2020-07-25 $2,500 107 DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) Analysed #499030 Valid Cross-site Scripting – 2019-05-04 – 106 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content" Analysed #669438 Valid No weakness recorded – 2019-09-09 $500 104 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature Analysed #334205 Valid Input Validation and Logic – 2018-04-18 $2,500 103 Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid} Analysed #1558010 Valid Cross-site Scripting High 2022-05-25 – 102 Creation of bounties through Customer API leads to private email disclosure Analysed #2382120 Valid Information Disclosure Critical 2024-03-26 – 101 How the Arch Angel stole Live Events Analysed #2285198 Valid No weakness recorded None 2023-12-15 – 98 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report Analysed #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted request Analysed #861170 Valid Denial of Service – 2020-05-25 – 97 Subdomain takeover of resources.hackerone.com Analysed #863551 Valid No weakness recorded – 2020-05-15 $500 95 Password not checked when disabling 2FA on HackerOne Analysed #587910 Valid Misconfiguration and Insecure Design – 2019-06-07 – 95 Race Condition in Flag Submission Analysed #454949 Valid Race Conditions – 2019-07-22 – 94 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 Team object in GraphQL disclosed total number of whitelisted hackers Analysed #342978 Valid Information Disclosure – 2018-05-12 $2,500 93 Reading redacted data via hackbot's answers Analysed #247628 Valid Information Disclosure – 2017-07-27 $1,500 93 `exportReportPdf` mutation shows internal Activity Analysed #3577216 Valid No weakness recorded High 2026-07-29 – 92 Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale Analysed #2476149 Valid No weakness recorded Low 2024-05-09 – 91 Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer #2263294 Informative Input Validation and Logic None 2024-05-10 – 91 Bypass report submit restriction/ban using the API key Analysed #2081930 Valid Access Control Medium 2023-10-29 – 91 Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users Analysed #1034346 Valid Insecure Direct Object Reference High 2020-11-17 – 91 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control – 2018-12-05 $2,500 90 SQL Injection in CVE Discovery Search Analysed #1893800 Valid SQL Injection High 2023-03-06 – 87 Unauthenticated user can upload an attachment to the last updated report draft Analysed #419896 Valid Memory Corruption – 2018-10-09 – 87 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86 Some limited confidential information can still be accessed after a user exits a private program Analysed #2278865 Valid Information Disclosure Medium 2024-01-19 $50 86 Scope information is leaked when visiting policy scopes tab of any External Program Analysed #1868473 Valid Access Control Medium 2023-03-10 – 86 "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statistics Analysed #696266 Valid Information Disclosure – 2020-02-21 $500 86 Triager/Team members can edit hacker's report and hacker is not even notified #2061367 Valid No weakness recorded Medium 2023-08-31 $2,500 84 HTML Injection in email via Name field #1581499 Valid Cross-site Scripting Low 2022-09-18 $500 84 Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com) #995995 Valid Cross-site Scripting None 2020-11-09 – 84 Login CSRF vulnerability on hackerone.com #834366 Valid Cross-Site Request Forgery – 2020-06-12 $500 84 Program admins could add verified domains to an organization #2323303 Valid Access Control Low 2024-03-07 – 83 Draft report exposure via slack alerting system for programs #2069593 Valid Information Disclosure Medium 2023-10-06 – 83 Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent] #1043372 Valid Denial of Service Low 2021-02-02 – 83 Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile #2553026 Valid Misconfiguration and Insecure Design Low 2025-03-13 – 82 Possible PII Disclosure via Advanced Vetting Process - ██████ #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 Improper UUID validation results in bypass of #419896 #423073 Valid Input Validation and Logic – 2018-10-25 – 82 [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse #2241266 Informative Misconfiguration and Insecure Design Medium 2024-05-30 – 81 Private information exposed through GraphQL filters #645299 Valid Information Disclosure – 2019-07-23 – 81 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter #2106708 Valid Cross-site Scripting Low 2023-08-22 – 80 inviting collaborator using email disclose the hackerone account related to the user #2045722 Valid Information Disclosure Medium 2024-09-19 – 80 latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users #724944 Valid Information Disclosure – 2019-11-10 – 79