Improper Access Control - Access to "Active Hiring" (Premium feature) filter results Analysed #3235855 Valid Access Control Medium 2026-02-03 – 100 IDOR allows an attacker to delete anyone's featured photo. Analysed #1608735 Valid Insecure Direct Object Reference Medium 2023-08-24 – 99 IDOR to make someone attend or leave an event Analysed #1734639 Valid Insecure Direct Object Reference Medium 2026-03-06 – 87 Information disclosure by sending a GIF Analysed #1801427 Valid Input Validation and Logic Medium 2023-04-28 – 84 Forced OAuth authorization using button ID in hash and holding space Analysed #2649615 Valid Authentication Medium 2024-12-17 – 79 Entire database of emails exposed through URN injection Analysed #1806939 Valid Command and Code Injection Medium 2023-05-22 – 79 Access to Deactivated LinkedIn Company Pages via Competitor Analytics API Analysed #3604288 Valid Insecure Direct Object Reference Medium 2026-03-24 – 77 Employee-only Area Bypass Analysed #2299571 Valid Access Control Medium 2024-02-19 – 77 Can access the job name, creator name and can report any draft/under review/rejected job Analysed #1581528 Valid Insecure Direct Object Reference Medium 2022-07-20 – 65 Users can access exams in course without having to subscribe to PREMIUM Analysed #1892888 Valid Access Control Medium 2024-01-10 – 64 Blocking a company page admin prevents him from delete paid media admin or edit his roles Analysed #2339192 Valid Access Control Medium 2026-03-05 – 55 CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/* Analysed #1964211 Valid Cross-Site Request Forgery Medium 2023-12-06 – 53 IDOR - Delete technical skill assessment result & Gained Badges result of any user Analysed #1592587 Valid No weakness recorded Medium 2022-10-05 – 48 Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings] Analysed #1572591 Valid Access Control Medium 2022-08-26 – 48 Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning` Analysed #1813450 Valid Insecure Direct Object Reference Medium 2023-05-12 – 44 Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewed Analysed #1837309 Valid Insecure Direct Object Reference Medium 2023-05-17 – 43 CSRF that makes any user send invitations to the attacker by simply clicking on a link. Analysed #1961163 Valid Cross-Site Request Forgery Medium 2023-12-06 – 41 bypass two-factor authentication. Analysed #1842183 Valid Authentication Medium 2023-08-01 – 41 Delete any LinkedIn comment on learning API of other users Analysed #1801527 Valid Access Control Medium 2023-05-12 – 41 Deny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id} Analysed #2081744 Valid Access Control Medium 2023-10-19 – 34 An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report] Analysed #1675674 Valid Input Validation and Logic Medium 2023-08-24 – 34 “See who’s interested in working for your company” - security issue Analysed #1945417 Valid Information Disclosure Medium 2023-06-21 – 28 [ Continuation Report from #1814842 ] Can create articles using other users' NewsLetters #1818969 Valid Insecure Direct Object Reference Medium 2023-05-15 – 23 Campaign Account Balance and History Disclosed in API Response #1587374 Valid Insecure Direct Object Reference Medium 2022-11-30 – 21 The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more su #1591504 N/A Authentication Medium 2022-06-15 – 3