Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Add labels to arbitrary issues/prs & compromise github actions label checksAnalysed#3527771	Valid	Insecure Direct Object Reference	Medium	2026-03-19	–	71
RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionAnalysed#2216036	Valid	Misconfiguration and Insecure Design	Medium	2024-01-12	–	50
Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gatingAnalysed#3527788	Valid	Insecure Direct Object Reference	Medium	2026-08-25	–	46
Rogue collaborators and ambiguous branch names in GitHubAnalysed#1831528	Valid	Input Validation and Logic	–	2023-12-05	–	43
Smuggling content in PR with refs/replace in GitHubAnalysed#1938106	Valid	Injection and Smuggling	Medium	2023-08-01	–	35
Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code ExecutionAnalysed#2017600	Valid	Injection and Smuggling	Medium	2023-11-29	–	25

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.