Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorizationAnalysed#3689633 | Valid | Insecure Direct Object Reference | Medium | 2026-08-26 | – | 31 |
| Any authenticated user can download full list of users, including email#228399 | Valid | Information Disclosure | Medium | 2017-06-17 | $256 | 19 |
| Users can bookmark other user's messages#192611 | Valid | Access Control | Medium | 2017-01-10 | – | 7 |
| Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786)#3738834 | Valid | Information Disclosure | Medium | 2026-10-26 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.