Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsAnalysed#689314	Valid	Access Control	Critical	2019-11-27	$12,000	457
An attacker can run pipeline jobs as arbitrary userAnalysed#894569	Valid	Input Validation and Logic	Critical	2020-08-26	$12,000	307
Privilege escalation from any user (including external) to gitlab admin when admin impersonates youAnalysed#493324	Valid	Access Control	Critical	2020-08-26	–	256
Git flag injection leading to file overwrite and potential remote code executionAnalysed#653125	Valid	Command and Code Injection	Critical	2019-12-19	$3,500	169
Privilege escalation of "external user" (with maintainer privilege) to internal access through project tokenAnalysed#1193062	Valid	Access Control	Medium	2021-10-11	–	66
Ability to access all user authentication tokens, leads to RCEAnalysed#158330	Valid	Access Control	Critical	2016-11-03	–	61
Guest users can create new test casesAnalysed#1113289	Valid	Access Control	Medium	2021-08-30	$650	49
A deactivated user can access data through GraphQLAnalysed#1192460	Valid	Access Control	Medium	2021-08-30	–	47
Exposure of a valid Gitlab-Workhorse JWT leading to various bad thingsAnalysed#1040786	Valid	Authentication	High	2022-07-05	$10,000	36
Privilege escalation due to insecure use of logrotateAnalysed#578119	Valid	Access Control	Low	2019-10-01	–	32

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.