Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
17 of 15,219 reports · 227 analysed so far
- #178152ValidRead files on application server, leads to RCEGitLab · Information Disclosure · 2016–114votes
- #158330ValidAbility to access all user authentication tokens, leads to RCEGitLab · Access Control · 2016–61votes
- #149598ValidInsecure 2FA/authentication implementation creates a brute force vulnerabilityGitLab · Misconfiguration and Insecure Design · 2016–33votes
- #174983ValidMailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.comGitLab · Access Control · 2016–31votes
- #128085ValidBypassing password authentication of users that have 2FA enabledGitLab · Authentication · 2016–27votes
- #131210ValidPrivilege escalation to access all private groups and repositoriesGitLab · Access Control · 2016–17votes
- #136333ValidPersistent XSS on public wiki pagesGitLab · Cross-site Scripting · 2016–14votes
- #186194ValidState filter in IssuableFinder allows attacker to delete all issues and merge requestsGitLab · Access Control · 2016–11votes
- #159984ValidXSS On meta tags in profile pageGitLab · Cross-site Scripting · 2016–11votes
- #162147ValidBoards leak private label names and desciptionsGitLab · Information Disclosure · 2016–10votes
- #128051ValidAttacker can extract list of private project's project membersGitLab · Information Disclosure · 2016–10votes
- #129736ValidPersistent XSS on public project pageGitLab · Cross-site Scripting · 2016–8votes
- #134305ValidPrivate snippets in public / internal projects leaked though GitLab APIGitLab · Information Disclosure · 2016–7votes
- #132777ValidLabels created in private projects are leakedGitLab · Information Disclosure · 2016–7votes
- #134299ValidAttacker can post notes on private MR, snippets, and issuesGitLab · Access Control · 2016–6votes
- #134292ValidAttacker can delete (and read) private project webhooksGitLab · Access Control · 2016–6votes
- #134300ValidConfidential issues leaked in public projects when attached to milestoneGitLab · Information Disclosure · 2016–5votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.