Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
44 of 15,219 reports · 161 analysed so far
- #337755ValidCan delete other user's post and company page postLinkedIn · Access Control · 2023–156votes
- #3475626ValidSession Cookie Leakage via Static Header Field in WebViewerFragmentLinkedIn · Misconfiguration and Insecure Design · 2026 · High–131votes
- #425007ValidPersistent XSS (unvalidated Open Graph embed) at LinkedIn.comLinkedIn · No weakness recorded · 2018–119votes
- #1716300ValidUnauthorized User can View Subscribers of Other Users NewslettersLinkedIn · Insecure Direct Object Reference · 2023–117votes
- #3151001ValidPrevious commentor on post can still comment even after comment permission is changed to disabledLinkedIn · Access Control · 2026 · Low–112votes
- #1777095ValidUnauthorized access to resumes stored on LinkedInLinkedIn · Insecure Direct Object Reference · 2022–112votes
- #2534458ValidCan see phone numbers of others by providing mail addressLinkedIn · Information Disclosure · 2024 · High–111votes
- #3079966ValidHTML Injection in LinkedIn Premium Support ChatLinkedIn · No weakness recorded · 2025 · Low–102votes
- #3235855ValidImproper Access Control - Access to "Active Hiring" (Premium feature) filter resultsLinkedIn · Access Control · 2026 · Medium–100votes
- #1608735ValidIDOR allows an attacker to delete anyone's featured photo.LinkedIn · Insecure Direct Object Reference · 2023–99votes
- #2291999ValidAn attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.LinkedIn · Insecure Direct Object Reference · 2024–94votes
- #2212950ValidStored XSS on LinkedIn App via iframe tag in ArticleLinkedIn · Cross-site Scripting · 2024–93votes
- #1734639ValidIDOR to make someone attend or leave an eventLinkedIn · Insecure Direct Object Reference · 2026 · Medium–87votes
- #1808719ValidAttackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per monthLinkedIn · Insecure Direct Object Reference · 2023–84votes
- #1801427ValidInformation disclosure by sending a GIFLinkedIn · Input Validation and Logic · 2023–84votes
- #2649615ValidForced OAuth authorization using button ID in hash and holding spaceLinkedIn · Authentication · 2024 · Medium–79votes
- #1806939ValidEntire database of emails exposed through URN injectionLinkedIn · Command and Code Injection · 2023–79votes
- #3604288ValidAccess to Deactivated LinkedIn Company Pages via Competitor Analytics APILinkedIn · Insecure Direct Object Reference · 2026 · Medium–77votes
- #2299571ValidEmployee-only Area BypassLinkedIn · Access Control · 2024–77votes
- #2131224ValidAttackers can *Upgrade and claim offer* on the Premium Trial Subscription with a total price of *IDR0.00* from the original *IDR7,022,061.82*LinkedIn · Input Validation and Logic · 2024 · High–70votes
- #1581528ValidCan access the job name, creator name and can report any draft/under review/rejected jobLinkedIn · Insecure Direct Object Reference · 2022–65votes
- #1892888ValidUsers can access exams in course without having to subscribe to PREMIUMLinkedIn · Access Control · 2024–64votes
- #1728087ValidUser Details Can Be Disclosed Even If The Account IS In Hibernation StateLinkedIn · Information Disclosure · 2023–57votes
- #2339192ValidBlocking a company page admin prevents him from delete paid media admin or edit his rolesLinkedIn · Access Control · 2026 · Medium–55votes
- #2215418ValidHtml injection in event DescriptionLinkedIn · Input Validation and Logic · 2024–55votes
- #1964211ValidCSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*LinkedIn · Cross-Site Request Forgery · 2023–53votes
- #1592587ValidIDOR - Delete technical skill assessment result & Gained Badges result of any userLinkedIn · No weakness recorded · 2022–48votes
- #1572591ValidPrivilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]LinkedIn · Access Control · 2022–48votes
- #1813450ValidAttackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning`LinkedIn · Insecure Direct Object Reference · 2023–44votes
- #1837309ValidAnyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewedLinkedIn · Insecure Direct Object Reference · 2023–43votes
- #1961163ValidCSRF that makes any user send invitations to the attacker by simply clicking on a link.LinkedIn · Cross-Site Request Forgery · 2023–41votes
- #1842183Validbypass two-factor authentication.LinkedIn · Authentication · 2023–41votes
- #1801527ValidDelete any LinkedIn comment on learning API of other usersLinkedIn · Access Control · 2023–41votes
- #2081744ValidDeny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id}LinkedIn · Access Control · 2023–34votes
- #1675674ValidAn Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report]LinkedIn · Input Validation and Logic · 2023–34votes
- #2076019ValidHTML injection at Company Name or Product Name and can be shown on Contact Sales formLinkedIn · No weakness recorded · 2023–32votes
- #1791720ValidAd Account TakeoverLinkedIn · Access Control · 2023–30votes
- #1945417Valid“See who’s interested in working for your company” - security issueLinkedIn · Information Disclosure · 2023–28votes
- #1818969Valid[ Continuation Report from #1814842 ] Can create articles using other users' NewsLettersLinkedIn · Insecure Direct Object Reference · 2023–23votes
- #1587374ValidCampaign Account Balance and History Disclosed in API ResponseLinkedIn · Insecure Direct Object Reference · 2022–21votes
- #1862677ValidAttacker can unpin posts from companies he's not part of.LinkedIn · No weakness recorded · 2023–20votes
- #1607645InformativeAdd me email address Authentication bypassLinkedIn · No weakness recorded · 2022–8votes
- #1578121N/ARate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact)LinkedIn · No weakness recorded · 2022–7votes
- #1591504N/AThe software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more suLinkedIn · Authentication · 2022–3votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.