Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information Analysed #2937622 Valid Information Disclosure Medium 2025-05-31 – 226 Google Docs link in JS files allows editing & reading survey information Analysed #2180521 Valid Information Disclosure Medium 2023-11-04 – 217 IDOR vulnerability in unreleased HackerOne Copilot feature Analysed #2218334 Valid Insecure Direct Object Reference Medium 2023-10-25 – 210 IDOR Vulnerability at AddTagToAssets operation name Analysed #2633771 Valid Insecure Direct Object Reference Medium 2025-06-08 – 178 LLM01: Invisible Prompt Injection Analysed #2372363 Valid Injection and Smuggling Medium 2024-05-13 – 159 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155 Banned user still has access to their deleted account via HackerOne's API using their API key Analysed #1577940 Valid Access Control Medium 2025-07-14 – 150 Server Side Request Forgery (SSRF) in webhook functionality Analysed #2301565 Valid Server-Side Request Forgery Medium 2024-01-30 $2,500 140 Bypassing HackerOne 2FA due to race condition Analysed #2598548 Valid Input Validation and Logic Medium 2024-10-30 – 139 Payload delivery via Social Media urls on H1 profile Analysed #2483422 Valid File and Path Handling Medium 2024-07-23 – 138 Takeover of hackerone.engineering via Github Analysed #2085260 Valid Access Control Medium 2023-07-31 – 135 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv #2381253 Valid Access Control Medium 2024-06-20 $500 111 Banned user still able to invited to reports as a collabrator and reset the password #1959219 Valid Access Control Medium 2023-07-06 – 107 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed #2040756 Valid Access Control Medium 2024-01-04 – 93 Bypass report submit restriction/ban using the API key #2081930 Valid Access Control Medium 2023-10-29 – 91 Able to Create Testimonials for myself using Sandbox #2490953 Valid Access Control Medium 2024-05-22 – 86 Some limited confidential information can still be accessed after a user exits a private program #2278865 Valid Information Disclosure Medium 2024-01-19 $50 86 Scope information is leaked when visiting policy scopes tab of any External Program #1868473 Valid Access Control Medium 2023-03-10 – 86 Triager/Team members can edit hacker's report and hacker is not even notified #2061367 Valid No weakness recorded Medium 2023-08-31 $2,500 84 Draft report exposure via slack alerting system for programs #2069593 Valid Information Disclosure Medium 2023-10-06 – 83 Possible PII Disclosure via Advanced Vetting Process - ██████ #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse #2241266 Informative Misconfiguration and Insecure Design Medium 2024-05-30 – 81 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 inviting collaborator using email disclose the hackerone account related to the user #2045722 Valid Information Disclosure Medium 2024-09-19 – 80 Asset Inventory Internal Descriptions are leaked in CSV export #2011431 Valid Input Validation and Logic Medium 2023-07-12 – 76 Residual Malicious Payloads on HackerOne after Vulnerability Fixes #3168691 Valid Input Validation and Logic Medium 2026-04-16 – 72 Being able to disclose IBB bounty table of any public program #2322082 Valid Information Disclosure Medium 2024-03-17 – 72 Private data related to program exposed via /reports/<id>.json endpoint to external user participant #2580982 Informative Information Disclosure Medium 2024-08-30 – 68 Private draft report exposure in a program a user is added as a viewer to #2552205 Valid Information Disclosure Medium 2024-09-17 $2,500 66 "package_name" can be set as desired when submitting a Pentest Opportunity form #2431495 Valid Access Control Medium 2024-06-19 – 63 Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint #2357012 Valid No weakness recorded Medium 2024-05-24 – 60 Organization members can delete reports in teams they have no access to #2203432 Valid Access Control Medium 2023-11-22 – 57 New Search Feature: Search for non-public words in limited disclosure reports #2213251 Valid Information Disclosure Medium 2023-10-25 – 55 Staff and Triage can modify the initial post of a report, including of already disclosed reports #2096271 Valid Access Control Medium 2023-08-28 – 50 Bypass comment restriction #2679108 Informative Access Control Medium 2024-09-19 – 48 Two factor authentication bypass #2463279 Duplicate No weakness recorded Medium 2024-07-11 – 47 Reset the 2FA of the user which can lead to Account Takeover #2492631 Duplicate Access Control Medium 2024-07-11 – 37 Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation #2719622 Informative No weakness recorded Medium 2024-09-19 – 33 Internal machine learning API endpoint for CWE classification is vulnerable to path traversal #2032778 Valid File and Path Handling Medium 2023-07-05 – 33 Private information exposed through GraphQL search endpoints aggregates #1838329 Valid Information Disclosure Medium 2023-01-19 – 32 2FA Bypass via Leaked Cookies #2479622 Informative Authentication Medium 2024-07-11 – 28 Session Not Expire / 2FA Bypass #2469706 Informative Authentication Medium 2024-07-11 – 28 Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query #1824342 Valid Information Disclosure Medium 2023-02-22 – 21 Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA #2575079 Duplicate No weakness recorded Medium 2024-07-11 – 13