Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PIIAnalysed#1148697 | Valid | Insecure Direct Object Reference | High | 2022-04-07 | – | 64 |
| Full read SSRF in flyte-poc-us-east4.uberinternal.comAnalysed#1540906 | Valid | Server-Side Request Forgery | Medium | 2022-05-26 | $2,000 | 30 |
| Uber Test Report 20220301#1496297 | Valid | Input Validation and Logic | Medium | 2022-03-03 | – | 22 |
| Golang expvar Information DisclosureAnalysed#1650035 | Valid | Information Disclosure | Low | 2022-08-24 | – | 16 |
| Exposed Golang Pprof debugger at https://cn-geo1.uber.com/Analysed#1385906 | Valid | Information Disclosure | Low | 2022-04-07 | – | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.