Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Access body and title of Internal Repo Issues in ProjectsAnalysed#2501036	Valid	Information Disclosure	Medium	2024-07-31	–	100
GitHub Apps can access suspended installations via scoped user-to-server tokensAnalysed#2484635	Valid	Access Control	Medium	2024-07-31	–	90
Invite tokens have Insufficient entropy in GHES Management ConsoleAnalysed#2197801	Valid	Cryptography	Medium	2024-01-12	–	81
Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/newAnalysed#2246576	Valid	Cross-site Scripting	Medium	2024-04-15	–	76
Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)Analysed#2505761	Valid	Information Disclosure	Medium	2024-10-17	$4,000	72
View private repository NWO of deploy key via internal LFS APIAnalysed#2469713	Valid	Access Control	Medium	2024-07-23	–	70
View Repo and Title of Any Private Check RunAnalysed#2210179	Valid	Insecure Direct Object Reference	Medium	2024-01-08	–	64
Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository TransferAnalysed#2190827	Valid	Access Control	Medium	2024-03-15	–	57
Persistent Unauthorized Administrative Access on All Organization Repositories via RC in User Conversion to OrganizationAnalysed#2185545	Valid	Authentication	Medium	2024-03-15	–	51
RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionAnalysed#2357443	Valid	Misconfiguration and Insecure Design	Medium	2024-09-17	–	50
RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionAnalysed#2216036	Valid	Misconfiguration and Insecure Design	Medium	2024-01-12	–	50
[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissionsAnalysed#2184950	Valid	Access Control	Medium	2024-01-03	–	42
[PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permissionAnalysed#2209433	Valid	Access Control	Medium	2024-01-03	–	31

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.