Reports Programs Subdomains Program: GitLab Status Severity Weakness Year Bounty paid8 Access stated No account 0 A user account 0 Admin or privileged 0 No option matches.
Access needed Technique: IDOR / object reference Clear filters 10 of 15,219 reports Disclosed bug bounty reports Report Status Weakness Severity Disclosed Bounty Votes Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control Critical 2019-11-27 $12,000 457 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure Critical 2019-04-20 $12,000 366 Steal private objects of other projects via project import Analysed #743953 Valid Insecure Direct Object Reference Critical 2022-06-07 $20,000 254 Snippet JS template allows attacker to read a user's private snippets Analysed #348443 Valid Information Disclosure Low 2019-03-03 $300 165 Importing GitLab project archives can replace uploads of other users Analysed #534794 Valid Insecure Direct Object Reference High 2019-12-11 – 148 Private objects exposed through project import Analysed #767770 Valid Insecure Direct Object Reference Critical 2022-06-07 $20,000 133 IDOR Exposes All Machine Learning Models Analysed #2528293 Valid Insecure Direct Object Reference Medium 2024-10-01 $1,160 117 RepositoryPipeline allows importing of local git repos Analysed #1685822 Valid Access Control Medium 2022-11-04 $22,300 89 Privilege escalation of "external user" (with maintainer privilege) to internal access through project token Analysed #1193062 Valid Access Control Medium 2021-10-11 – 66 GitLab CI runner can read and poison cache of all other projects Analysed #301432 Valid File and Path Handling Critical 2018-04-27 $2,000 43
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.