Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.comAnalysed#498964	Valid	Access Control	Critical	2019-04-19	–	306
Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAnalysed#922456	Valid	Authentication	High	2020-10-01	$3,000	257
Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainAnalysed#565883	Valid	Input Validation and Logic	Medium	2019-08-30	–	249
Ability To Delete User(s) Account Without User InteractionAnalysed#928255	Valid	Misconfiguration and Insecure Design	High	2021-03-17	–	221
Mint Oauth2 access token for targeted userAnalysed#1148364	Valid	Authentication	High	2025-07-23	$5,580	140
Bypass Email Verification using Salesforce -- Reproducible in gitlab.comAnalysed#617896	Valid	Misconfiguration and Insecure Design	High	2019-12-13	–	55
Access to GitLab's Slack by abusing issue creation from e-mailAnalysed#218230	Valid	Authentication	Critical	2017-09-21	–	54
Improper access control for users with expired password, giving the user full access through API and GitAnalysed#1285226	Valid	Access Control	Medium	2022-01-27	–	49

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,444 analysed so far), which can be wrong. Data as of 2026-11-15.