Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Session Cookie Leakage via Static Header Field in WebViewerFragmentAnalysed#3475626	Valid	Misconfiguration and Insecure Design	High	2026-03-17	–	131
Unauthorized User can View Subscribers of Other Users NewslettersAnalysed#1716300	Valid	Insecure Direct Object Reference	High	2023-03-29	–	117
Unauthorized access to resumes stored on LinkedInAnalysed#1777095	Valid	Insecure Direct Object Reference	High	2022-12-07	–	112
Can see phone numbers of others by providing mail addressAnalysed#2534458	Valid	Information Disclosure	High	2024-11-13	–	111
An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.Analysed#2291999	Valid	Insecure Direct Object Reference	High	2024-03-12	–	94
Attackers can use TRIAL Premium only by paying IDR 10,000.00 from the original price of `IDR462,400.00` per monthAnalysed#1808719	Valid	Insecure Direct Object Reference	High	2023-08-24	–	84
Attackers can Upgrade and claim offer on the Premium Trial Subscription with a total price of IDR0.00 from the original IDR7,022,061.82Analysed#2131224	Valid	Input Validation and Logic	High	2024-06-18	–	70

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.