Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting57
- Cross-Site Request Forgery6
- Open Redirect5
- Server-Side Request Forgery18
- SQL Injection1
- Command and Code Injection18
- Injection and Smuggling4
- File and Path Handling5
- Memory Corruption1
- Denial of Service14
- Input Validation and Logic7
- Misconfiguration and Insecure Design15
- Information Disclosure32
- Authentication9
- Access Control52
- Insecure Direct Object Reference12
- No weakness recorded1
Access (title)Any
Access (analysis)Any
TechniqueAny
- Any
- Information disclosure6
- Path traversal6
- Missing authorisation check5
- OS command injection4
- Business logic flaw3
- SSRF3
- Stored XSS3
- Code injection / eval2
- IDOR / object reference2
- Leaked secret or key2
- Privilege escalation2
- Unsafe file upload2
- Account takeover chain1
- Authentication bypass1
- CSP bypass1
- HTML injection1
- Local file inclusion1
- Parameter pollution1
- Password reset flaw1
- SSRF through a redirect1
- Unsafe deserialisation1
257 of 15,219 reports · $594,110 in bounties · 161 analysed so far
- #827052ValidAnalysedArbitrary file read via the UploadsRewriter when moving and issueGitLab · File and Path Handling · 2020 · needs: a user account · Path traversal, Local file inclusion$20,0001,503votes
- #2293343ValidAnalysedAccount Takeover via Password Reset without user interactionsGitLab · Access Control · 2025 · Critical · needs: no account · Account takeover chain, Password reset flaw, Parameter pollution$35,000989votes
- #658013ValidAnalysedGit flag injection - local file overwrite to remote code executionGitLab · Command and Code Injection · 2019 · needs: a user account · OS command injection, Path traversal$12,000777votes
- #446585ValidAnalysedExfiltrate and mutate repository and project data through injected templated serviceGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, Information disclosure, SSRF$11,000762votes
- #526325ValidAnalysedStored XSS in Wiki pagesGitLab · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–633votes
- #587854ValidAnalysedLocal files could be overwritten in GitLab, leading to remote command executionGitLab · Command and Code Injection · 2019 · needs: a user account · Path traversal, OS command injection$12,000542votes
- #1154542ValidAnalysedRCE when removing metadata with ExifToolGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval, Unsafe file upload$20,000508votes
- #689314ValidAnalysedProject Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, IDOR / object reference, Privilege escalation$12,000457votes
- #1125425ValidAnalysedRCE via unsafe inline Kramdown options when rendering certain Wiki pagesGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval$20,000427votes
- #850447ValidAnalysedgitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readGitLab · Information Disclosure · 2020 · needs: a user account · Missing authorisation check, Information disclosure, Path traversal$10,000410votes
- #1679624ValidAnalysedRemote Command Execution via Github importGitLab · Command and Code Injection · 2022 · needs: a user account · OS command injection, Unsafe deserialisation$33,510392votes
- #1609965ValidAnalysedRCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)GitLab · Command and Code Injection · 2022 · needs: a user account · OS command injection$33,510387votes
- #509924ValidAnalysedJSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsGitLab · Information Disclosure · 2019 · needs: a user account · IDOR / object reference, Missing authorisation check, Information disclosure, Leaked secret or key$12,000366votes
- #409395ValidAnalysedBypass of GitLab CI runner slash fix in YAML validationGitLab · Input Validation and Logic · 2019 · needs: a user account · Path traversal, Business logic flaw–363votes
- #826361ValidAnalysedSSRF on project import via the remote_attachment_url on a NoteGitLab · Server-Side Request Forgery · 2020 · needs: a user account · SSRF$10,000359votes
- #502593ValidAnalysedAttacker is able to access commit title and team member comments which are supposed to be privateGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, Information disclosure–351votes
- #632101ValidAnalysedServer Side Request Forgery mitigation bypassGitLab · Server-Side Request Forgery · 2020 · needs: a user account · SSRF, SSRF through a redirect–350votes
- #1439593ValidAnalysedArbitrary file read via the bulk imports UploadsPipelineGitLab · File and Path Handling · 2022 · needs: a user account · Path traversal, Unsafe file upload, Information disclosure, Leaked secret or key$29,000329votes
- #1212067ValidAnalysedStored XSS in markdown via the DesignReferenceFilterGitLab · Cross-site Scripting · 2021 · needs: a user account · Stored XSS, CSP bypass$16,000317votes
- #894569ValidAnalysedAn attacker can run pipeline jobs as arbitrary userGitLab · Input Validation and Logic · 2020 · needs: a user account · Privilege escalation, Business logic flaw$12,000307votes
- #498964ValidAnalysedFull access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.comGitLab · Access Control · 2019 · needs: no account · Authentication bypass, Business logic flaw, Information disclosure–306votes
- #1731349ValidAnalysedStored XSS via Kroki diagramGitLab · Cross-site Scripting · 2023 · needs: a user account · Stored XSS, HTML injection$13,950295votes
- #662287ValidCross-site Scripting (XSS) - Stored in RDoc wiki pagesGitLab · Misconfiguration and Insecure Design · 2019$3,500282votes
- #1672388ValidRCE via github importGitLab · Command and Code Injection · 2022–271votes
- #922456ValidAbility to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesGitLab · Authentication · 2020$3,000257votes
- #493324ValidPrivilege escalation from any user (including external) to gitlab admin when admin impersonates youGitLab · Access Control · 2020–256votes
- #743953ValidSteal private objects of other projects via project importGitLab · Insecure Direct Object Reference · 2022$20,000254votes
- #565883ValidBypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainGitLab · Input Validation and Logic · 2019–249votes
- #398799ValidUnauthenticated blind SSRF in OAuth Jira authorization controllerGitLab · Server-Side Request Forgery · 2019 · no account (title)$4,000238votes
- #878779ValidFull Read SSRF on Gitlab's Internal GrafanaGitLab · Server-Side Request Forgery · 2020–229votes
- #928255ValidAbility To Delete User(s) Account Without User InteractionGitLab · Misconfiguration and Insecure Design · 2021–221votes
- #692252ValidGroup search leaks private MRs, code, commitsGitLab · Access Control · 2019–212votes
- #1132378ValidArbitrary file read during project importGitLab · File and Path Handling · 2021$16,000194votes
- #1665658ValidStored-XSS with CSP-bypass via labels' colorGitLab · Cross-site Scripting · 2023–169votes
- #653125ValidGit flag injection leading to file overwrite and potential remote code executionGitLab · Command and Code Injection · 2019$3,500169votes
- #348443ValidSnippet JS template allows attacker to read a user's private snippetsGitLab · Information Disclosure · 2019$300165votes
- #1481207ValidStored XSS in Notes (with CSP bypass for gitlab.com)GitLab · Cross-site Scripting · 2022–161votes
- #534794ValidImporting GitLab project archives can replace uploads of other usersGitLab · Insecure Direct Object Reference · 2019–148votes
- #460545Validinformation disclosure of secret_key_base via encoding charctersGitLab · Information Disclosure · 2019$3,500146votes
- #470067ValidDoS on the Issue page by exploiting Mermaid.GitLab · Denial of Service · 2019$3,000145votes
- #733072ValidPath traversal, to RCEGitLab · Command and Code Injection · 2022$12,000142votes
- #1148364ValidMint Oauth2 access token for targeted userGitLab · Authentication · 2025 · High$5,580140votes
- #508184ValidPersistent XSS in Note objectsGitLab · Cross-site Scripting · 2019$4,500139votes
- #824689ValidSend arbitrary PUT requests when user clicks on a linkGitLab · Command and Code Injection · 2020–135votes
- #767770ValidPrivate objects exposed through project importGitLab · Insecure Direct Object Reference · 2022$20,000133votes
- #1198517ValidStored XSS in custom emojiGitLab · Cross-site Scripting · 2021$3,000130votes
- #682442ValidGit flag injection - Search API with scope 'blobs'GitLab · Command and Code Injection · 2019$7,000130votes
- #2528293ValidIDOR Exposes All Machine Learning ModelsGitLab · Insecure Direct Object Reference · 2024 · Medium$1,160117votes
- #178152ValidRead files on application server, leads to RCEGitLab · Information Disclosure · 2016–114votes
- #979787ValidAble to view hackerone reports attachmentsGitLab · Information Disclosure · 2022–103votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.