IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query Analysed #2122671 Valid Insecure Direct Object Reference High 2023-08-29 – 395 IDOR allows user to access report details via reference.json endpoint Analysed #3862641 Valid Insecure Direct Object Reference Critical 2026-10-01 $15,000 372 Insecure Direct Object Reference (IDOR) - Delete Campaigns Analysed #1969141 Valid Insecure Direct Object Reference High 2023-05-03 – 346 Attachment disclosure via summary report Analysed #2442008 Valid Insecure Direct Object Reference Critical 2024-04-29 – 340 An attacker can archive and unarchive any structured scope object on HackerOne Analysed #1501611 Valid No weakness recorded High 2022-04-18 – 318 Information Disclosure in /skills call Analysed #188719 Valid Information Disclosure Medium 2017-01-05 $10,000 287 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure High 2016-11-30 $12,500 269 Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint Analysed #2487889 Valid Insecure Direct Object Reference Critical 2024-05-23 – 266 IDOR vulnerability in unreleased HackerOne Copilot feature Analysed #2218334 Valid Insecure Direct Object Reference Medium 2023-10-25 – 210 IDOR Vulnerability at AddTagToAssets operation name Analysed #2633771 Valid Insecure Direct Object Reference Medium 2025-06-08 – 178 Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint Analysed #536853 Valid Insecure Direct Object Reference Low 2019-04-23 – 161 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Any user could upload attachments to pentest scoping form they don't have access to Analysed #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Internal Gitlab Ticket Disclosure via External Slack Channels Analysed #1273292 Valid Information Disclosure High 2021-08-04 – 118 [IDOR] Improper Access Control on Embedded Submission Form Analysed #2483666 Valid Insecure Direct Object Reference Low 2024-06-19 $2,500 110 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users Analysed #1034346 Valid Insecure Direct Object Reference High 2020-11-17 – 91 Unauthenticated user can upload an attachment to the last updated report draft Analysed #419896 Valid Memory Corruption High 2018-10-09 – 87 Possible PII Disclosure via Advanced Vetting Process - ██████ Analysed #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" Analysed #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 IDOR on HackerOne Feedback Review Analysed #262661 Valid Insecure Direct Object Reference Low 2017-09-02 – 79 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member Analysed #2632876 Valid Access Control Low 2024-12-24 – 77 Any organization's assets pending review can be downloaded Analysed #1787644 Valid Information Disclosure High 2022-11-29 – 76 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid Insecure Direct Object Reference Medium 2019-10-25 – 76 Validation message in Bounty award endpoint can be used to determine program balances Analysed #293299 Valid Information Disclosure Medium 2017-11-29 – 73 IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs Analysed #510759 Valid Insecure Direct Object Reference Low 2019-09-06 – 67 Any user with access to program can resume and suspend HackerOne Gateway Analysed #717716 Valid Insecure Direct Object Reference Medium 2019-10-21 – 65 HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information Analysed #378122 Valid Information Disclosure None 2018-07-26 – 60 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid Access Control Medium 2023-11-22 – 57 Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details Analysed #447930 Valid Insecure Direct Object Reference High 2019-01-11 – 54 Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information Analysed #1242680 Valid Information Disclosure Low 2021-06-24 – 46 Response program can create bounty table Analysed #460920 Valid Input Validation and Logic Low 2019-01-07 $500 46 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot Analysed #357485 Valid Access Control Low 2018-06-27 $500 45 GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend Analysed #800231 Valid Information Disclosure Medium 2020-05-11 – 42 Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs Analysed #1219011 Valid Information Disclosure Low 2021-06-30 $500 41 Report invitation links not restricted to any existing user Analysed #214839 Valid Information Disclosure Low 2017-05-23 $500 39 Accidental Access to Programs Information via SAML Login Analysed #438306 Valid No weakness recorded Critical 2018-11-14 – 34 IDOR in Bugs overview enables attacker to determine the date range a hackathon was active Analysed #663431 Valid Insecure Direct Object Reference Low 2019-12-13 – 33 HackerOne Pentesters can access any structured scope object through GraphQL node interface Analysed #781150 Valid Access Control High 2020-03-11 – 30 Can read features from any user Analysed #316810 Valid Information Disclosure Medium 2018-03-12 $250 28 Mishandling of hackerone clear background checks resulting in disclosure of other hacker's information Analysed #1240162 Valid Memory Corruption Medium 2021-08-05 – 23 People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed Analysed #353310 Valid Information Disclosure Low 2018-06-25 $500 23 Previous attachments can be referenced when creating a new report Analysed #129773 Valid Misconfiguration and Insecure Design Low 2019-04-12 – 17 PII data Leakage through hackerone reports Analysed #1256371 Valid Information Disclosure Low 2021-08-09 – 16 Moving a report to a different program doesn't reassign the Custom Field Values Analysed #511779 Valid Insecure Direct Object Reference Low 2019-04-25 – 15