Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | Command and Code Injection | Critical | 2021-05-14 | $20,000 | 508 |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425 | Valid | Command and Code Injection | Critical | 2021-04-20 | $20,000 | 427 |
| Stored XSS in markdown via the DesignReferenceFilterAnalysed#1212067 | Valid | Cross-site Scripting | Critical | 2021-10-18 | $16,000 | 317 |
| Ability To Delete User(s) Account Without User InteractionAnalysed#928255 | Valid | Misconfiguration and Insecure Design | High | 2021-03-17 | – | 221 |
| Arbitrary file read during project importAnalysed#1132378 | Valid | File and Path Handling | Critical | 2021-05-24 | $16,000 | 194 |
| Stored XSS in custom emojiAnalysed#1198517 | Valid | Cross-site Scripting | High | 2021-07-19 | $3,000 | 130 |
| XSS in request approvalsAnalysed#402658 | Valid | Cross-site Scripting | – | 2021-04-23 | $3,000 | 96 |
| CSRF on /api/graphql allows executing mutations through GET requestsAnalysed#1122408 | Valid | Cross-Site Request Forgery | High | 2021-08-02 | $3,370 | 88 |
| Cache poisoning Denial of Service affecting assets.gitlab-static.net#1160407 | Valid | Denial of Service | High | 2021-12-22 | – | 83 |
| Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"#1256777 | Valid | Cross-site Scripting | High | 2021-09-15 | – | 80 |
| Privilege escalation of "external user" (with maintainer privilege) to internal access through project token#1193062 | Valid | Access Control | Medium | 2021-10-11 | – | 66 |
| Stored-XSS on wiki pages#1087061 | Valid | Cross-site Scripting | Medium | 2021-07-13 | – | 59 |
| Stored XSS via Mermaid Prototype Pollution vulnerability#1106238 | Valid | Cross-site Scripting | High | 2021-07-12 | $3,000 | 58 |
| FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.com#1092230 | Valid | Server-Side Request Forgery | High | 2021-07-13 | – | 58 |
| Change project visibility to a restricted option#1086781 | Valid | Misconfiguration and Insecure Design | Medium | 2021-12-30 | $1,370 | 51 |
| Stored XSS on the job page#856554 | Valid | Cross-site Scripting | – | 2021-01-08 | $3,000 | 50 |
| Guest users can create new test cases#1113289 | Valid | Access Control | Medium | 2021-08-30 | $650 | 49 |
| View the Starred Projects in a Private Profile#703894 | Valid | Insecure Direct Object Reference | – | 2021-02-02 | $500 | 49 |
| Stored XSS via Mermaid Prototype Pollution vulnerability#1280002 | Valid | Cross-site Scripting | High | 2021-11-18 | $3,000 | 48 |
| A deactivated user can access data through GraphQL#1192460 | Valid | Access Control | Medium | 2021-08-30 | – | 47 |
| Stored XSS in Mermaid when viewing Markdown files#1212822 | Valid | Cross-site Scripting | High | 2021-10-18 | – | 42 |
| Kroki Arbitrary File Read/Write#1098793 | Valid | Access Control | High | 2021-05-21 | $5,600 | 41 |
| When you call your branch the same name as a git hash, it could be checked out by dependents#790634 | Valid | Injection and Smuggling | – | 2021-08-19 | $2,000 | 39 |
| Clipboard DOM-based XSS#1196958 | Valid | Cross-site Scripting | Medium | 2021-08-19 | – | 35 |
| Stored-XSS in merge requests#977697 | Valid | Cross-site Scripting | High | 2021-07-13 | – | 33 |
| Remote hacker can download all the files of master branch in public projects where everything is members only.#1043480 | Valid | Authentication | Medium | 2021-02-15 | – | 31 |
| Guest Users can create issues for Sentry errors and track their status#1117768 | Valid | Access Control | Low | 2021-09-24 | $610 | 29 |
| Able to leak private email of any user given his/her username via graphql#972355 | Valid | Information Disclosure | Medium | 2021-01-08 | – | 29 |
| Drive-by arbitrary file deletion in the GDK via letter_opener_web gem#1353103 | Valid | Cross-Site Request Forgery | Medium | 2021-11-12 | $750 | 27 |
| Stored DOM XSS via Mermaid chart#1103258 | Valid | Cross-site Scripting | High | 2021-07-12 | $3,000 | 27 |
| A profile page of a user can be denied from loading by appending .html to the username#475098 | Valid | Misconfiguration and Insecure Design | – | 2021-08-30 | $200 | 26 |
| Reporters can upload design to issues using the "Move to" feature#1112297 | Valid | Access Control | Medium | 2021-10-18 | $600 | 21 |
| [information disclosure] Validate existence of a private project.#605608 | Valid | Information Disclosure | – | 2021-03-09 | – | 14 |
| ReDoS in syntax highlighting due to Rouge#1283484 | Valid | Denial of Service | Medium | 2021-11-15 | $600 | 13 |
| GraphQL Query leads to sensitive information disclosure#985124 | Duplicate | Information Disclosure | Medium | 2021-03-08 | – | 12 |
| Revoked User can still view the Merge Request created by him via API#962604 | Valid | Access Control | Medium | 2021-03-15 | $1,500 | 9 |
| Responsible Disclosure of Privacy Leakage Issue#1089914 | Informative | Information Disclosure | High | 2021-06-29 | – | 7 |
| Stored-XSS in merge requests#1261148 | Informative | Cross-site Scripting | None | 2021-07-19 | – | 6 |
| Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities#874401 | Informative | Information Disclosure | Medium | 2021-11-15 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (965 analysed so far), which can be wrong. Data as of 2026-11-14.