Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Arbitrary Read of Another Users private repository without AuthorizationAnalysed#3124517	Valid	Insecure Direct Object Reference	High	2025-09-23	$10,000	276
Missing Access Control in MigrationFile allows attacker to upload files to any Migration#3506183	Valid	Insecure Direct Object Reference	High	2026-03-05	–	92
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-check#2325023	Valid	Command and Code Injection	High	2024-09-17	–	88
GitHub scoped user to server tokens can escape their installation#3638909	Valid	Access Control	High	2026-07-29	–	80
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forward#2332623	Valid	Command and Code Injection	High	2024-09-13	–	80
OAuth redirect uri validation bypass for :proxima_first_party_sync apps#3588801	Valid	Open Redirect	High	2026-07-21	–	79
Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise Server#2336236	Valid	No weakness recorded	High	2024-09-13	–	71
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection#2332551	Valid	Command and Code Injection	High	2024-09-13	–	61
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ng#2329466	Valid	Command and Code Injection	High	2024-09-13	–	61
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectd#2329547	Valid	Command and Code Injection	High	2024-09-17	–	47
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-console#2323292	Valid	Command and Code Injection	High	2024-09-17	–	47

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.