Attachment disclosure via summary report Analysed #2442008 Valid Insecure Direct Object Reference Critical 2024-04-29 – 340 Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint Analysed #2487889 Valid Insecure Direct Object Reference Critical 2024-05-23 – 266 View Titles of Private Reports with pending email invitation Analysed #2312029 Valid Access Control High 2024-01-16 – 257 HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization Analysed #2101076 Valid Memory Corruption High 2024-02-04 – 228 Account creation with invalid email addresses / email is accepting % and %0d%0a line termination chars Analysed #815085 Valid Misconfiguration and Insecure Design Low 2024-02-04 $3,750 176 LLM01: Invisible Prompt Injection Analysed #2372363 Valid Injection and Smuggling Medium 2024-05-13 – 159 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid Access Control Low 2024-06-06 – 149 Server Side Request Forgery (SSRF) in webhook functionality Analysed #2301565 Valid Server-Side Request Forgery Medium 2024-01-30 $2,500 140 Bypassing HackerOne 2FA due to race condition Analysed #2598548 Valid Input Validation and Logic Medium 2024-10-30 – 139 Payload delivery via Social Media urls on H1 profile Analysed #2483422 Valid File and Path Handling Medium 2024-07-23 – 138 Any user could upload attachments to pentest scoping form they don't have access to Analysed #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 [IDOR] Improper Access Control on Embedded Submission Form Analysed #2483666 Valid Insecure Direct Object Reference Low 2024-06-19 $2,500 110 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 Creation of bounties through Customer API leads to private email disclosure Analysed #2382120 Valid Information Disclosure Critical 2024-03-26 – 101 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report Analysed #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale Analysed #2476149 Valid No weakness recorded Low 2024-05-09 – 91 Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer #2263294 Informative Input Validation and Logic None 2024-05-10 – 91 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86 Some limited confidential information can still be accessed after a user exits a private program Analysed #2278865 Valid Information Disclosure Medium 2024-01-19 $50 86 Program admins could add verified domains to an organization Analysed #2323303 Valid Access Control Low 2024-03-07 – 83 Possible PII Disclosure via Advanced Vetting Process - ██████ Analysed #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse #2241266 Informative Misconfiguration and Insecure Design Medium 2024-05-30 – 81 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" Analysed #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 inviting collaborator using email disclose the hackerone account related to the user Analysed #2045722 Valid Information Disclosure Medium 2024-09-19 – 80 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member Analysed #2632876 Valid Access Control Low 2024-12-24 – 77 Being able to disclose IBB bounty table of any public program Analysed #2322082 Valid Information Disclosure Medium 2024-03-17 – 72 Private data related to program exposed via /reports/<id>.json endpoint to external user participant #2580982 Informative Information Disclosure Medium 2024-08-30 – 68 Non Org Admin/Group Manager can create groups in an organization Analysed #2372018 Valid Access Control High 2024-07-23 – 68 Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery #2501984 Informative Authentication Critical 2024-07-11 – 67 Private draft report exposure in a program a user is added as a viewer to Analysed #2552205 Valid Information Disclosure Medium 2024-09-17 $2,500 66 Minor security issue with Hackerone Invitations from sandbox program Analysed #2430179 Valid Input Validation and Logic Low 2024-07-22 – 64 Takeover of hackerone.engineering via Medium Analysed #2709660 Valid Authentication Low 2024-11-14 – 63 "package_name" can be set as desired when submitting a Pentest Opportunity form Analysed #2431495 Valid Access Control Medium 2024-06-19 – 63 View any user email using the Team's audit log section #2404415 Duplicate Information Disclosure Critical 2024-03-26 – 61 LLM03: Training Data Poisoning via ASCII decoding #2370955 Informative Injection and Smuggling None 2024-05-28 – 61 Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint Analysed #2357012 Valid No weakness recorded Medium 2024-05-24 – 60 Bypass comment restriction #2679108 Informative Access Control Medium 2024-09-19 – 48 Two factor authentication bypass #2463279 Duplicate No weakness recorded Medium 2024-07-11 – 47 Business Logic error leads to bypass 2FA requirement #2571981 Duplicate Input Validation and Logic High 2024-07-11 – 39 Reset the 2FA of the user which can lead to Account Takeover #2492631 Duplicate Access Control Medium 2024-07-11 – 37 Two-factor authentication bypass lead to information disclosure about the program and all hackers participate #2486086 Duplicate Information Disclosure High 2024-07-11 – 37 Ability to bulk submit reports via query named based batching Analysed #2166697 Valid Misconfiguration and Insecure Design Low 2024-06-19 $500 37 Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation #2719622 Informative No weakness recorded Medium 2024-09-19 – 33 Bypassing Two-Factor Authentication via Account Deactivation and Password Reset #2543342 Duplicate Access Control None 2024-07-11 – 33 Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program #2569993 Informative Access Control Low 2024-07-11 – 32 Improper Authentication - 2FA OTP Reusable #2529780 Duplicate Authentication High 2024-07-11 – 31