Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
IDOR Exposes All Machine Learning ModelsAnalysed#2528293	Valid	Insecure Direct Object Reference	Medium	2024-10-01	$1,160	117
Subdomain takeover in Gitlab pages#2523654	Valid	Misconfiguration and Insecure Design	Low	2024-10-09	–	79
Remove obsolete domain from handbook subdomain#2599840	Valid	Misconfiguration and Insecure Design	Low	2024-10-01	–	72
Stored-XSS injected in Wiki page via Banzai pipeline#2257080	Valid	Cross-site Scripting	High	2024-05-28	–	71
Login email verification bypass via `/oauth/token`.#2676025	Informative	Authentication	None	2024-09-03	–	66
DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server#2499070	Valid	Denial of Service	Medium	2024-10-09	$2,300	64
HTML injection possible with soft email confirmations when Administrator manually confirms attacker email address#1935628	Valid	Injection and Smuggling	Low	2024-10-08	$1,060	61
Removed Guest role user who dosent have access to private project in members able to view jobs#2668302	Informative	Access Control	None	2024-09-18	–	38
Maintainer can leak sentry token by changing the configured URL (fix bypass)#2104591	Valid	Information Disclosure	Medium	2024-10-08	–	32
ReDoS due to device-detector parsing user agents#1772063	Valid	Denial of Service	Medium	2024-10-08	–	23

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.