Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting1
- Cross-Site Request Forgery1
- Open Redirect1
- Command and Code Injection7
- Injection and Smuggling4
- Deserialization and Object Injection1
- Denial of Service1
- Input Validation and Logic1
- Misconfiguration and Insecure Design3
- Cryptography1
- Information Disclosure3
- Authentication1
- Access Control14
- Insecure Direct Object Reference6
- No weakness recorded2
Access (title)Any
47 of 15,219 reports · $46,617 in bounties · 161 analysed so far
- #3124517ValidArbitrary Read of Another Users private repository without AuthorizationGitHub · Insecure Direct Object Reference · 2025 · High$10,000276votes
- #1711938ValidGithub Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiGitHub · Access Control · 2023–198votes
- #2579939ValidSAML Signature verification bypass allows logging into any user (with specific conditions)GitHub · Access Control · 2024 · Critical–196votes
- #1901040ValidAuthentication bypass on gist.github.com through SSH CertificatesGitHub · Access Control · 2023$10,000182votes
- #1497169ValidCSRF protection bypass in GitHub Enterprise management consoleGitHub · Cross-Site Request Forgery · 2022$10,000152votes
- #3560256ValidCross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationGitHub · Insecure Direct Object Reference · 2026 · Medium–108votes
- #3713965ValidAble to bypass authorization logic and gain more access then intendedGitHub · No weakness recorded · 2026 · Medium–105votes
- #2501036ValidAccess body and title of Internal Repo Issues in ProjectsGitHub · Information Disclosure · 2024 · Medium–100votes
- #1732595ValidGithub app Privilege Escalation to Administrator/Owner of the OrganizationGitHub · Access Control · 2023–98votes
- #3506183ValidMissing Access Control in MigrationFile allows attacker to upload files to any MigrationGitHub · Insecure Direct Object Reference · 2026 · High–92votes
- #2484635ValidGitHub Apps can access suspended installations via scoped user-to-server tokensGitHub · Access Control · 2024 · Medium–90votes
- #2325023ValidManagement Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-checkGitHub · Command and Code Injection · 2024 · High–88votes
- #2197801ValidInvite tokens have Insufficient entropy in GHES Management ConsoleGitHub · Cryptography · 2024–81votes
- #3638909ValidGitHub scoped user to server tokens can escape their installationGitHub · Access Control · 2026 · High–80votes
- #2332623ValidManagement Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forwardGitHub · Command and Code Injection · 2024 · High–80votes
- #3588801ValidOAuth redirect uri validation bypass for :proxima_first_party_sync appsGitHub · Open Redirect · 2026 · High–79votes
- #2246576ValidSelf XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/newGitHub · Cross-site Scripting · 2024–76votes
- #2505761ValidInformation Leakage via Clicked Link in GitHub Repository (Fingerprinting)GitHub · Information Disclosure · 2024 · Medium$4,00072votes
- #3527771ValidAdd labels to arbitrary issues/prs & compromise github actions label checksGitHub · Insecure Direct Object Reference · 2026 · Medium–71votes
- #2336236ValidPrivilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise ServerGitHub · No weakness recorded · 2024 · High–71votes
- #2469713ValidView private repository NWO of deploy key via internal LFS APIGitHub · Access Control · 2024 · Medium–70votes
- #2210179ValidView Repo and Title of Any Private Check RunGitHub · Insecure Direct Object Reference · 2024–64votes
- #2383092ValidSource Code and data exfiltration via Github CopilotGitHub · Command and Code Injection · 2024 · Low–63votes
- #3641229ValidGitHub user to server tokens can create issues in any public repositoryGitHub · Access Control · 2026 · Medium–62votes
- #2332551ValidManagement Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injectionGitHub · Command and Code Injection · 2024 · High–61votes
- #2329466ValidManagement Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ngGitHub · Command and Code Injection · 2024 · High–61votes
- #3522254ValidPATs without the required scope can leak issuesGitHub · Access Control · 2026 · Medium–59votes
- #2190827ValidBypassing Collaborator Restrictions: Retaining Admin Access Post-Repository TransferGitHub · Access Control · 2024–57votes
- #2197796ValidGHES Management console EoP (editor to site admin)GitHub · Access Control · 2024–56votes
- #1690427ValidManaging PagesGitHub · Access Control · 2022–54votes
- #1619604ValidDoS via markdown API from unauthenticated userGitHub · Denial of Service · 2022 · no account (title)$4,00054votes
- #2185545ValidPersistent Unauthorized Administrative Access on All Organization Repositories via RC in User Conversion to OrganizationGitHub · Authentication · 2024–51votes
- #2357443ValidRC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionGitHub · Misconfiguration and Insecure Design · 2024 · Medium–50votes
- #2216036ValidRC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionGitHub · Misconfiguration and Insecure Design · 2024–50votes
- #2329547ValidManagement Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectdGitHub · Command and Code Injection · 2024 · High–47votes
- #2323292ValidManagement Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-consoleGitHub · Command and Code Injection · 2024 · High–47votes
- #3527788ValidAdd labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gatingGitHub · Insecure Direct Object Reference · 2026 · Medium–46votes
- #1831528ValidRogue collaborators and ambiguous branch names in GitHubGitHub · Input Validation and Logic · 2023–43votes
- #2184950Valid[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissionsGitHub · Access Control · 2024–42votes
- #1625652ValidDelimiter injection in GitHub Actions core.exportVariableGitHub · Misconfiguration and Insecure Design · 2022$4,61739votes
- #1938106ValidSmuggling content in PR with refs/replace in GitHubGitHub · Injection and Smuggling · 2023–35votes
- #3290630ValidSample report: Denial of serviceGitHub · Information Disclosure · 2025 · None–33votes
- #1637621ValidCommand injection in GitHub Actions ContainerStepHostGitHub · Injection and Smuggling · 2022$4,00032votes
- #2209433Valid[PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permissionGitHub · Access Control · 2024–31votes
- #2017600ValidGit Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code ExecutionGitHub · Injection and Smuggling · 2023–25votes
- #1762025ValidImproper handling of null bytes in GitHub Actions Runner allows an attacker to set arbitrary environment variablesGitHub · Injection and Smuggling · 2023–19votes
- #1593913Valid[Git Gud] GitHub.com Svnbridge memcached deserialization vulnerability chain leading to Remote Code ExecutionGitHub · Deserialization and Object Injection · 2022–14votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.