Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS & SSRF in Lark DocsAnalysed#892049 | Valid | Server-Side Request Forgery | Critical | 2021-02-05 | $3,000 | 178 |
| Server Side Request ForgeryAnalysed#644238 | Valid | Server-Side Request Forgery | Critical | 2021-03-29 | – | 164 |
| Full read SSRF via Lark Docs `import as docs` featureAnalysed#1409727 | Valid | Server-Side Request Forgery | Critical | 2022-01-28 | $5,000 | 124 |
| Attacker is able to join any tenant on larksuite and view personal files/chats.Analysed#1363185 | Valid | Access Control | Critical | 2021-11-03 | – | 84 |
| SSRF with information disclosureAnalysed#810401 | Valid | Server-Side Request Forgery | Medium | 2021-04-27 | – | 64 |
| [Lark Android] Vulnerability in exported activity WebViewAnalysed#694053 | Valid | Cross-site Scripting | Medium | 2021-07-22 | $1,000 | 63 |
| Able to steal private files by manipulating response using Compose Email function of LarkAnalysed#1373784 | Valid | Insecure Direct Object Reference | High | 2022-01-25 | – | 50 |
| Reflected xss and open redirect on larksuite.com using /?back_uri= parameter.Analysed#955606 | Valid | Cross-site Scripting | Medium | 2022-01-13 | – | 49 |
| Non privileged user is able to approve his own app himself leading to mass privilege escalations.Analysed#1168475 | Valid | Access Control | High | 2021-11-20 | – | 45 |
| Sensitive information of helpdesk is being leaked.Analysed#805023 | Valid | Access Control | Medium | 2021-03-06 | – | 45 |
| Accessing/Editing Folders of Other Users in the Orginisation.Analysed#1025881 | Valid | Access Control | High | 2022-10-29 | – | 42 |
| Improper Access Control allows OTP bypassAnalysed#1948506 | Valid | Access Control | Medium | 2023-10-25 | – | 40 |
| [IDOR] Modify other team's reminders via reminderId parameterAnalysed#946323 | Valid | Insecure Direct Object Reference | Medium | 2022-01-13 | – | 40 |
| Able to steal private files by manipulating response using Auto Reply function of LarkAnalysed#1387320 | Valid | Insecure Direct Object Reference | High | 2022-01-25 | – | 39 |
| RPC Implementation allows unauthenticated remote callsAnalysed#876022 | Valid | Cross-site Scripting | High | 2021-02-10 | $1,250 | 39 |
| Improper generating of access link at go.larksuite.com leads to access to other organizations/users' private dataAnalysed#785577 | Valid | No weakness recorded | Medium | 2021-02-27 | – | 33 |
| [CSRF] No Csrf protection against sending invitation to join the team.Analysed#728199 | Valid | Cross-Site Request Forgery | Medium | 2022-10-20 | – | 30 |
| Stored XSS in Satisfaction Surveys via "Ask Reason for Dissatisfaction" optionAnalysed#953791 | Valid | Cross-site Scripting | Medium | 2021-02-23 | – | 29 |
| Improper Access Control on Lark Footer FeatureAnalysed#1169340 | Valid | Access Control | High | 2021-05-18 | – | 28 |
| Hyper Link Injection while signupAnalysed#864751 | Valid | Input Validation and Logic | Low | 2021-01-03 | – | 28 |
| Privilege Escalation to All-staff groupAnalysed#1021460 | Valid | Access Control | Medium | 2022-10-28 | – | 26 |
| Users Without Permission Can Download Restricted FilesAnalysed#794904 | Valid | Access Control | Medium | 2022-10-18 | – | 25 |
| Normal User is able to EXPORT Feature Usage StatisticsAnalysed#1470076 | Valid | Access Control | Medium | 2022-03-04 | – | 21 |
| Access to private file's of helpdesk.Analysed#804534 | Valid | Access Control | Medium | 2022-10-18 | – | 21 |
| User with single department permission can view applicant list of all department'sAnalysed#877300 | Valid | Access Control | Medium | 2021-03-03 | – | 20 |
| Stealing app credentials by reflected xss on Lark Suite#791278 | Valid | Cross-site Scripting | Medium | 2021-02-26 | – | 19 |
| Removed user can still view comments on the file/documents.#1335070 | Valid | Access Control | Medium | 2022-10-20 | – | 18 |
| Stored xss on helpdesk using user's city#971857 | Valid | Cross-site Scripting | Medium | 2022-01-14 | – | 18 |
| Ability to View Non-Permitted Admin Log#1533220 | Valid | Access Control | Medium | 2022-10-20 | – | 17 |
| Viewer is able to leak the previous versions of the file#1080700 | Valid | Access Control | Medium | 2022-10-24 | – | 17 |
| IDOR Allows Viewer to Delete Bin's Files#1074420 | Valid | Access Control | Medium | 2022-10-24 | – | 16 |
| Messages disclosure via search feature of other users group(Cross-Tenant).#912161 | Valid | Insecure Direct Object Reference | Medium | 2021-03-17 | – | 15 |
| Stored xss in larksuite internal helpdesk and other user's helpdesk.#884931 | Valid | Cross-site Scripting | Medium | 2021-02-19 | – | 13 |
| [AWC-Pune] - User can download files deleted by Admin using shortcuts#1463028 | Valid | No weakness recorded | Medium | 2022-02-25 | – | 11 |
| In orginization stored xss using location (Larksuite survey app)#998138 | Valid | Cross-site Scripting | Medium | 2022-01-14 | – | 11 |
| Sub-Dept User Can Add User's To Main Department.#890209 | Valid | Access Control | Medium | 2022-10-18 | – | 10 |
| Reflected XSS on Lark Suite#700726 | Valid | Cross-site Scripting | Medium | 2021-03-19 | – | 10 |
| Server Side Request Forgery#659565 | Valid | Server-Side Request Forgery | Low | 2021-03-18 | – | 9 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.