IDOR on HackerOne Feedback Review #262661 Valid Insecure Direct Object Reference – 2017-09-02 – 79 Any one can view collaborater email address via path /reports/<id>/participants #1918362 Valid Access Control Low 2023-06-01 – 78 HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity #1826141 Valid Information Disclosure Low 2023-02-10 $500 78 Subdomain takeover #2 at info.hacker.one #209004 Valid Access Control – 2017-04-28 – 78 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member #2632876 Valid Access Control Low 2024-12-24 – 77 Near to Infinite loop when changing Group's name that has API token as Team Member #880187 Valid No weakness recorded Medium 2020-07-23 $2,500 77 Asset Inventory Internal Descriptions are leaked in CSV export #2011431 Valid Input Validation and Logic Medium 2023-07-12 – 76 Any organization's assets pending review can be downloaded #1787644 Valid Information Disclosure High 2022-11-29 – 76 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent #717729 Valid Insecure Direct Object Reference – 2019-10-25 – 76 Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?) #170310 Valid Misconfiguration and Insecure Design – 2016-12-08 – 76 Usernames still visible on report export pdf despite "I want to redact all usernames" is selected #2054222 Valid Information Disclosure Low 2023-08-08 $500 75 Team object in GraphQL discloses team group names and permissions #343464 Valid Information Disclosure – 2018-05-04 $2,500 75 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs #215625 Valid Information Disclosure – 2017-05-23 $2,000 75 Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted #958374 Valid Information Disclosure Low 2020-08-24 $500 74 Validation message in Bounty award endpoint can be used to determine program balances #293299 Valid Information Disclosure – 2017-11-29 – 73 Race condition leads to duplicate payouts #220445 Valid Access Control – 2017-05-23 – 73 Residual Malicious Payloads on HackerOne after Vulnerability Fixes #3168691 Valid Input Validation and Logic Medium 2026-04-16 – 72 Being able to disclose IBB bounty table of any public program #2322082 Valid Information Disclosure Medium 2024-03-17 – 72 Race condition in joining CTF group #1540969 Valid Race Conditions Low 2023-01-08 $500 72 Team object in GraphQL disclosed of private programs via the industry #707406 Valid No weakness recorded – 2019-11-23 $500 72 Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS. #929361 Valid Information Disclosure Low 2020-10-02 – 71 The hacker has access to the administrative part of the management reports in publish report #867249 Valid No weakness recorded Low 2020-12-16 $500 71 Potential stored Cross-Site Scripting vulnerability in Support Backend #858894 Valid Cross-site Scripting – 2020-05-04 – 71 The request tells the number of private programs, the new system of authorization /invite/token #310946 Valid Information Disclosure – 2018-02-14 $2,000 71 Homograph fix Bypass #271324 Valid Misconfiguration and Insecure Design – 2017-10-16 – 71 Private data related to program exposed via /reports/<id>.json endpoint to external user participant #2580982 Informative Information Disclosure Medium 2024-08-30 – 68 Non Org Admin/Group Manager can create groups in an organization #2372018 Valid Access Control High 2024-07-23 – 68 Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeover #514451 Valid Server-Side Request Forgery – 2019-04-04 $500 68 Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery #2501984 Informative Authentication Critical 2024-07-11 – 67 IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs #510759 Valid Insecure Direct Object Reference – 2019-09-06 – 67 Inline banner on Report page discloses whether organization runs a private program #452973 Valid Information Disclosure – 2018-12-11 $500 67 Private draft report exposure in a program a user is added as a viewer to #2552205 Valid Information Disclosure Medium 2024-09-17 $2,500 66 Private program disclosure of `██████████` through notifications #1179241 Valid Access Control Low 2021-06-09 $500 66 Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering #1132606 Valid Information Disclosure Medium 2021-08-24 – 66 Pixel flood attack #390 Valid Denial of Service – 2013-11-30 $500 66 Any user with access to program can resume and suspend HackerOne Gateway #717716 Valid Insecure Direct Object Reference – 2019-10-21 – 65 HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms #298265 Valid No weakness recorded – 2018-03-13 – 65 Minor security issue with Hackerone Invitations from sandbox program #2430179 Valid Input Validation and Logic Low 2024-07-22 – 64 Hackers can find out the ID of private programs #1129649 Valid Information Disclosure Low 2021-08-24 – 64 Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission #1039821 Valid No weakness recorded Low 2021-06-18 – 64 Partial report contents leakage - via HTTP/2 concurrent stream handling #493176 Valid Information Disclosure – 2021-08-05 $2,500 64 Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile #347693 Valid Information Disclosure – 2018-05-08 $2,500 64 Takeover of hackerone.engineering via Medium #2709660 Valid Authentication Low 2024-11-14 – 63 "package_name" can be set as desired when submitting a Pentest Opportunity form #2431495 Valid Access Control Medium 2024-06-19 – 63 Disclosure of Email title report in quick award paypout email (no content mode) #689997 Valid Information Disclosure – 2019-10-11 $500 62 Parameter pollution in social sharing buttons #105953 Valid Misconfiguration and Insecure Design – 2015-12-19 $500 62 View any user email using the Team's audit log section #2404415 Duplicate Information Disclosure Critical 2024-03-26 – 61 LLM03: Training Data Poisoning via ASCII decoding #2370955 Informative Injection and Smuggling None 2024-05-28 – 61 Query parameter reordering causes redirect page to render unsafe URL #293689 Valid Cross-site Scripting – 2017-11-30 $1,500 61 Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint #2357012 Valid No weakness recorded Medium 2024-05-24 – 60