Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
2FA bypass possible on https://authsvc.singlestore.com#3329361	Valid	Authentication	Medium	2025-10-22	–	96
IDOR - Scheduled data leak to other accounts By "projectID"#3219944	Valid	Input Validation and Logic	Medium	2025-08-12	–	77
Exceed the maximum number of subscribers using Race Condition#3221185	Valid	Input Validation and Logic	Low	2025-08-12	–	70
Exceeding the limit of Workspaces via Race Condition#3226838	Valid	Input Validation and Logic	Medium	2025-10-06	–	62
SELECT ... INTO OUTFILE does not enforce the FILE WRITE privilege unprivileged arbitrary file write on the server#3780695	Valid	Access Control	High	2026-07-13	–	50
Insecure Direct Object Reference (IDOR) allows creating folders.#3353057	Valid	Insecure Direct Object Reference	Low	2026-07-01	–	39
Delete any folder for any user within the organization#3353035	Valid	Insecure Direct Object Reference	Low	2026-07-01	–	35
Exceeding the maximum number of spaces allowed by exploiting a Race Condition in the Workspace creation process#3295500	Valid	Input Validation and Logic	Low	2026-07-01	–	35
Privilege Escalation – Access to the Alert Subscribers page for users with low privileges#3353000	Valid	Access Control	Low	2026-07-01	–	26
Insufficient checks in the file path parameter allow writing to unauthorized directories#3384615	Valid	File and Path Handling	Low	2026-06-24	–	12

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.