Remote code execution on Basecamp.com Analysed #365271 Valid Command and Code Injection – 2020-11-26 $5,000 417 HEY.com email stored XSS Analysed #982291 Valid Cross-site Scripting – 2020-10-27 $5,000 360 HTTP Request Smuggling via HTTP/2 Analysed #1211724 Valid Injection and Smuggling – 2021-08-27 $7,500 300 AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp Analysed #2107680 Valid Information Disclosure – 2023-09-21 $8,868 248 Account takeover via insecure intent handling #2516732 Valid Deserialization and Object Injection Medium 2024-05-30 – 136 a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of service #1018037 Valid Denial of Service – 2020-11-10 $1,000 132 Improper bot-authentication allows to impersonate any user when sending messages in a room #3329310 Valid Authentication High 2025-11-21 $2,000 128 User can upload files even after closing his account #1020371 Valid Authentication – 2021-03-29 – 124 Spam & Clearance checks disabled with existing referenced Message-ID #2012659 Valid Access Control Low 2026-01-21 $250 123 Able to steal bearer token from deep link #1372667 Valid Authentication – 2022-03-27 $6,337 110 Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity #3764217 Valid Access Control Medium 2026-07-04 – 104 Insecure Bundler configuration fetching internal Gems (okra) from Rubygems.org #1104874 Valid Command and Code Injection – 2021-08-10 $5,000 102 Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass #3581911 Valid Cross-site Scripting Low 2026-07-14 $337 89 Mutation Based Stored XSS on Trix Editor version latest (2.1.8) #2819573 Valid No weakness recorded Critical 2025-06-27 – 89 DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover #3608199 Valid Cross-site Scripting High 2026-04-14 – 82 stored XSS in hey.com message content #988272 Valid Cross-site Scripting – 2020-10-31 – 80 Two click Account Takeover #3079738 Valid Deserialization and Object Injection High 2025-11-11 – 77 Subdomain Takeover due to ████████ NS records at us-east4.37signals.com #1342422 Valid Information Disclosure – 2021-09-17 – 77 Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure #3467641 Valid Insecure Direct Object Reference Low 2026-03-16 $100 76 Stored XSS on trix editor version 2.1.1 #2521419 Valid Cross-site Scripting High 2024-11-04 $1,000 76 Information Disclosure .htaccess accesible for public #1241849 Valid No weakness recorded – 2021-07-18 – 76 Possible DOM XSS on app.hey.com #1010132 Valid Cross-site Scripting – 2020-10-27 – 68 Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click) #2553411 Valid File and Path Handling Medium 2024-07-09 – 65 Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addresses #3445890 Valid Server-Side Request Forgery Medium 2025-12-22 – 62 DNS Setup allows sending mail on behalf of other customers #981824 Valid Misconfiguration and Insecure Design – 2021-02-21 – 58 Attachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket) #403602 Valid Input Validation and Logic – 2020-11-26 – 57 Bypass of image rewriting / tracking blocker via srcset #1021885 Valid Information Disclosure – 2020-12-03 $1,000 56 Launchpad file read leaks production keys #3962925 Valid File and Path Handling Critical 2026-10-28 $9,337 55 Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure #3543475 Valid Access Control Low 2026-04-14 – 53 Critical Data Breach - Big Data for all domains #2686225 Valid No weakness recorded Medium 2025-01-14 – 53 Premium Email Address Check Bypass - Hey #963774 Valid Input Validation and Logic – 2020-12-15 – 53 launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API #3955956 Valid Authentication High 2026-10-30 – 49 One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML #3943339 Valid Cross-site Scripting High 2026-10-02 – 49 Password reset link not expiring after changing password in settings #1288898 Valid Authentication – 2021-08-10 $250 49 Domain Takeover [3737signals.com] #1253926 Valid Input Validation and Logic – 2021-08-13 – 48 Remote Code Execution in Basecamp Windows Electron App #1016966 Valid Command and Code Injection – 2020-11-19 – 48 Error Page Content Spoofing or Text Injection #1245051 Valid Misconfiguration and Insecure Design – 2021-07-14 $100 45 Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses #4035023 Valid Access Control High 2026-10-20 – 44 CSRF on launchpad.37signals.com OAuth2 authorization endpoint #850022 Valid Cross-Site Request Forgery – 2020-10-30 – 44 Information Disclosure of Garbage Collection Cycle 'Again' #1026196 Valid Information Disclosure – 2020-12-16 $100 41 Arbitrary write in the application's data folder and arbitrary read of server's replies from 3rd party apps. #1710541 Valid File and Path Handling – 2023-06-07 – 38 Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook #3979217 Valid Authentication High 2026-10-30 – 34 A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option #3999856 Valid Access Control High 2026-10-30 – 33 Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow #3972760 Valid Open Redirect Medium 2026-10-15 – 33 Information Disclosure of Garbage Collection Cycle #981796 Valid Information Disclosure – 2020-11-04 – 33 Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com #2552879 Valid Deserialization and Object Injection Medium 2024-07-09 – 31 RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.com #1456063 Valid Deserialization and Object Injection – 2022-04-26 $100 30 Lack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCE #1019389 Valid No weakness recorded – 2021-04-22 $250 29 HTTP request smuggling on Basecamp 2 allows web cache poisoning #919175 Valid Injection and Smuggling – 2020-10-28 – 28 Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce #3981292 Valid Cross-site Scripting High 2026-10-28 – 27