Web
Not rated
BUG BOUNTY WRITEUPS
Broken access control writeups
Users doing things their role shouldn't allow. Missing permission checks, revoked access that still works, admin endpoints left open. The most common class in disclosed reports.
452 reports and writeups from 2024 to 2026. 323 carry a severity from the disclosing platform, 98 of them rated High or Critical. Last updated 2026-10-30.
Latest Broken access control reports
Search and filter all writeupsWeb, API
Not rated
Web, API
Not rated
Windows
Not rated
A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option
HackerOneBasecamp2026-10-30
Web
High
Web
Not rated
Revoked deployment collaborator regains access to private comments after active collaborator interaction
HackerOneVercel2026-10-29$1,026 bounty
Web
Medium
How a Sneaker Order Led Me to an IDOR Vulnerability (and $50)
Medium2026-10-28
Web
Not rated
Permission Model filesystem over-grant via wildcard radix lookup
HackerOneNode.js2026-10-27
Web
Low
Understanding BOLA in Spring Boot: From Vulnerable Endpoints to Ownership-Based Authorization
Medium2026-10-27
Web, API
Not rated
No password confirmation required when using apptoken on sensitive endpoint
HackerOneNextcloud2026-10-27
Web, API, Cloud
Medium
Tables application does not respect sharing limitations set by admin
HackerOneNextcloud2026-10-27
Web, Cloud
Medium
Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone
HackerOneNextcloud2026-10-27
Web, API, Cloud
Medium
Public shares remain accessible via alternate endpoints after owner account is disabled
HackerOneNextcloud2026-10-27$270 bounty
Web, API, Cloud
Medium
Unauthorised access with hidden public link creation when sharing to a Team External Member
HackerOneNextcloud2026-10-27$100 bounty
Web, Cloud
Low
FederationController::remoteWopiToken() returns full Wopi entity without token type validation
HackerOneNextcloud2026-10-27
Web, Cloud
Low
Files Confidential tagging can be bypassed with # in filename
HackerOneNextcloud2026-10-27
Web, Cloud
Medium
Cross-protocol redirect to imap:// or smtp:// uploads the -F/MIMEPOST form and the custom Authorization/Cookie headers to the redirect target
HackerOnecurl2026-10-26
Web
Low
Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process
HackerOneNextcloud2026-10-24
Web, Cloud
Low
dns.resolve truncates names containing NUL char
HackerOneNode.js2026-10-23
Web
High
Permission Model bypass with fs.realpathSync
HackerOneNode.js2026-10-23
Web
Low
Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses
HackerOneBasecamp2026-10-20
Web
High
An organization admin can create an attacker-controlled organization owner via the gem transfer flow
HackerOneRubyGems2026-10-15
Web
High
CVE-2026-94265: Authorization: Negotiate sent to foreign origin
HackerOnecurl2026-10-14
Web
Not rated
Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint
HackerOneWordPress2026-10-12
Web, API
Critical
Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read
HackerOneMariaDB2026-10-07
Binary
Critical
Privilege escalation via user controlled usernames / roles and views
HackerOneMariaDB2026-10-07
Web
Not rated
Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write
HackerOneMariaDB2026-10-07
Web
High
MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service
HackerOneMariaDB2026-10-07
Web
Medium
DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv causing privilege escalation
HackerOneMariaDB2026-10-07
Web
High
Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations
HackerOneWordPress2026-09-28
Web
Medium
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Researcher blog2026-09-24
Linux
Not rated
Privilege Escalation: How to Make Yourself an Admin
Medium2026-09-19
Web
Not rated
files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet
HackerOneNextcloud2026-09-18
Web, Cloud
Medium
Public collectives allow to create pages
HackerOneNextcloud2026-09-17
Web, Cloud
Low
Shared smart albums in the Photos app can expose files outside the album owner's configured source folders
HackerOneNextcloud2026-09-17
Web, Cloud
Medium
Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups
HackerOneNextcloud2026-09-17
Web, API, Cloud
Medium
Arbitrary Board Preference Injection via Deck Config API
HackerOneNextcloud2026-09-17$200 bounty
Web, API, Cloud
Medium
HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers
HackerOneCloudflare Public Bug Bounty2026-09-14$1,500 bounty
Web, Cloud
High
CORS Misconfiguration / Broken Access Control
HackerOneMyndr2026-09-10
Web
Not rated
49: Cookie-jar save transfers group access to a different GID
HackerOnecurl2026-09-08
Web
Not rated
ACL cache collision lets a role inherit privileges from a same-named socket user
HackerOneMariaDB2026-09-07
Web
Medium
MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover
HackerOneMariaDB2026-09-07
Web
High
KILL authorization trusts the presented login name instead of the authenticated anonymous account
HackerOneMariaDB2026-09-07
Web
Not rated
MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion
HackerOneMariaDB2026-09-07
Binary
Medium
Ticket Trick Attack allows access to ████████' workspaces
HackerOneRockstar Games2026-09-01
Web
High
Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint
HackerOneIBM2026-08-28
Web, API
Not rated
Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization
HackerOneDiscourse2026-08-26
Web
Medium
libcurl Digest/NTLM authentication ignores an explicit Authorization header
HackerOnecurl2026-08-25
Windows
Medium
Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution
HackerOneMonero2026-08-20
Web3, Windows
High
DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)
HackerOneRocket.Chat2026-08-20
Web
High
TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot
HackerOneNextcloud2026-08-14
Web, Cloud
Medium
JaaS SIP Gateway Authorization Bypass
HackerOne8x82026-08-12$500 bounty
Web
Medium
Myndr CORS Misconfiguration
HackerOneMyndr2026-08-12
Web
Not rated
`relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`
HackerOneMonero2026-08-05
Web3
Low
Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths
HackerOneNode.js2026-07-30
Web
Low
Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
HackerOneNode.js2026-07-29
Web
High
Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`
HackerOneNode.js2026-07-29
Web
Low
GitHub scoped user to server tokens can escape their installation
HackerOneGitHub2026-07-29
Web
High
Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-07-27
Web, API, Cloud
Medium
GitHub user to server tokens can create issues in any public repository
HackerOneGitHub2026-07-22
Web, Source Code
Medium
Restricted RPC leaks alternative block hashes via /get_alt_blocks_hashes
HackerOneMonero2026-07-20
Web3
Low
Able to bypass authorization logic and gain more access then intended
HackerOneGitHub2026-07-15
Web
Medium
Bedrock AgentCore Starter Toolkit Creates Gateway IAM Roles Without Confused Deputy Protections
HackerOneAWS VDP2026-07-15
Web, Cloud
Medium
SELECT ... INTO OUTFILE does not enforce the FILE WRITE privilege unprivileged arbitrary file write on the server
HackerOneSingleStore2026-07-13
Web
High
Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)
HackerOneAWS VDP2026-07-09
Web, Cloud
Medium
29 Premium Plugin Packages with License Keys Publicly Accessible in Uploads Directory
HackerOneEssity2026-07-06
Web
Medium
Unauthenticated Plugin Settings Modification on Three Crocoblock/Jet Plugins
HackerOneEssity2026-07-06
Web
Medium
Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity
HackerOneBasecamp2026-07-04
Web
Medium
[Splatoon 3] Kick other players with NplnLogin message
HackerOneNintendo2026-07-02
Web
Medium
Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-07-02
Web, API, Cloud
Medium
Privilege Escalation – Access to the Alert Subscribers page for users with low privileges
HackerOneSingleStore2026-07-01
Web
Low
Permission Model bypass via FileHandle.utimes() in the promises API
HackerOneNode.js2026-06-25
Web, API
Low
Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)
HackerOneNode.js2026-06-25
Web
Low
XML‑RPC login leak exposes valid session ID enabling unauthorized API access
HackerOneRevive Adserver2026-06-25
Web, API
Medium
Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching
HackerOneNode.js2026-06-25
Web
Medium
Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
HackerOneNode.js2026-06-25
Web
Medium
Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column
HackerOneMozilla2026-06-23$2,000 bounty
Web
Medium
1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation
HackerOneKhan Academy2026-06-20
Web
Critical
Permission Model Bypass via `process.report.writeReport()` Path Misvalidation
HackerOneNode.js2026-06-18
Web
Low
Unauthenticated reading of every file via livechat auth and predicting MongoDB ObjectId()
HackerOneRocket.Chat2026-06-15
Web
Critical
Firecracker Out-of-bounds Read/Write Local Privilege Escalation Vulnerability
HackerOneAWS VDP2026-06-11
Web, Cloud
Not rated
Valid share tokens allow to access tempory upload files of share owner
HackerOneNextcloud2026-06-07
Web, Cloud
Medium
Missing access control when linking banners or campaigns to zones
HackerOneRevive Adserver2026-06-03
Web
Medium
Missing access control when modifying parent entities via XML‑RPC
HackerOneRevive Adserver2026-06-03
Web
Medium
Missing access control when linking trackers to campaigns
HackerOneRevive Adserver2026-06-03
Web
Medium
Banner status override by advertiser‑level users
HackerOneRevive Adserver2026-06-03
Web
Medium
page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise
HackerOneLY Corporation2026-06-02$1,000 bounty
Web
High
Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)
HackerOneNextcloud2026-05-21$150 bounty
Web, Cloud
Medium
Privilege-relevant fields are clientModify in SAP CDC schema allowing role escalation to Admin
HackerOneEssity2026-05-20
Web
Critical
Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers
HackerOnecurl2026-05-19
Web
Not rated
Unauthenticated File Upload to CDN
HackerOneEnjin2026-05-18
Web
Medium
QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions Denial
HackerOneAWS VDP2026-05-12
Web, Cloud
Not rated
View-only guests could see deleted Collectives pages in the trashbin
HackerOneNextcloud2026-05-08
Web, Cloud
Low
PS4 BD-J privilege escalation using nested JAR
HackerOnePlayStation2026-04-29$2,500 bounty
Web
Medium
Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net
HackerOnepixiv2026-04-27
Web
Low
RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logs
HackerOneRocket.Chat2026-04-23
Web, API
Medium
Complete authentication bypass to admin permissions
HackerOneRocket.Chat2026-04-22
Web
Critical
Authorization header leak in ssrf_filter via cross-host redirect leads to credential theft and unauthorized access
HackerOnearkadiyt-projects2026-04-15
Web
Not rated
Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure
HackerOneBasecamp2026-04-14
Web
Low
User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon
HackerOneMozilla2026-04-10
Web
Low
[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]
HackerOneMozilla2026-04-10
Web
Medium
Improper enforcement of CURLOPT_SOCKS5_AUTH due to missing reuse key validation in libcurl
HackerOnecurl2026-04-07
Web
Low
no_proxy IDN mismatch: Unicode hostnames bypass proxy exclusion list
HackerOnecurl2026-04-07
Web
Not rated
HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)
HackerOnecurl2026-03-31
Web
Medium
Permission Model Bypass in realpathSync.native Allows File Existence Disclosure
HackerOneNode.js2026-03-30
Web
Low
Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`
HackerOneNode.js2026-03-30
Web
Medium
CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown
HackerOneNode.js2026-03-30
Web
Low
Potential Subdomain Takeover on IBM.com domain.
HackerOneIBM2026-03-24
Web
High
Story of Abusing a Fully Secured redirect_uri in an OAuth Flow
Researcher blog2026-03-21
Web
Not rated
[Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale
HackerOneMozilla2026-03-20
Web
Low
PATs without the required scope can leak issues
HackerOneGitHub2026-03-19
Web
Medium
Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse
HackerOneHackerOne2026-03-18
Web
Low
Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signing
HackerOneMetaMask2026-03-13$350 bounty
Web
Medium
CVE-2026-3784: wrong proxy connection reuse with credentials
HackerOnecurl2026-03-11
Web
Low
Users can change project visibility which requires high subscription by just changing request body
HackerOneLovable VDP2026-03-09
Web
Medium
Blocking a company page admin prevents him from delete paid media admin or edit his roles
HackerOneLinkedIn2026-03-05
Web
Medium
Missing Access Control in MigrationFile allows attacker to upload files to any Migration
HackerOneGitHub2026-03-05
Web
High
2FA requirement bypass when inviting team members
HackerOneOmise2026-02-28
Web
Medium
Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)
HackerOneNode.js2026-02-12
Web
Medium
FS Permissions Bypass
HackerOneNode.js2026-02-12
Web
High
Previous commentor on post can still comment even after comment permission is changed to disabled
HackerOneLinkedIn2026-02-03
Web
Low
Improper Access Control - Access to "Active Hiring" (Premium feature) filter results
HackerOneLinkedIn2026-02-03
Web
Medium
Spam & Clearance checks disabled with existing referenced Message-ID
HackerOneBasecamp2026-01-21$250 bounty
Web
Low
[Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.
HackerOneStripo Inc2026-01-20
Web, AI
Critical
Can download files on Android app without permission
HackerOneNextcloud2026-01-16$250 bounty
Android, Cloud
Low
Easy way to create a new Deck board without permission
HackerOneNextcloud2026-01-16$100 bounty
Web, Cloud
Not rated
fs.futimes() Bypasses Read-Only Permission Model
HackerOneNode.js2026-01-15
Web
Low
Broken Access Control allows advertiser accounts to delete trackers they do not own
HackerOneRevive Adserver2026-01-14
Web
High
Unauthenticated Users Can Access Other Users’ Bug Report Attachments via Broken Access Control
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
ASBS Analytics Dashboard
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Air Force candidate PII + recruitment chat logs accessible via BAC/IDOR on █████████ (very large/significant exposure)
HackerOneU.S. Dept Of Defense2026-01-12
Web
Critical
Unauthenticated File Read Adobe ColdFusion
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
Exposed Sensitive PDF: Misconfigured Access Controls Leading to Information Disclosure
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Non-Production API Endpoints for the AI Ops Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-01-06
Web, API, Cloud
Medium
Users can modify tags on files that do not belong to them
HackerOneNextcloud2026-01-04$150 bounty
Web, Cloud
Medium
The role "CI-driven scan initiator" provides excessive read access
HackerOnePortSwigger Web Security2026-01-02
Web
Low
Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connection
HackerOnecurl2025-12-30
Web
High
HAProxy Connection Reuse leads to IP Spoofing and mTLS Context Smuggling
HackerOnecurl2025-12-23
Web
High
Nextcloud Tables v1 Share Enumeration Without Authorization (Regression of CVE-2024-52507)
HackerOneNextcloud2025-12-05
Web, Cloud
Low
Deck app allowed user with "Can share" permission to modify permissions of other non-owners
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Authorization bypass allows changing email address of other users
HackerOneRevive Adserver2025-11-19
Web
High
Existence of completed pods allows for bypass of Kubernetes NetworkPolicy
HackerOneAWS VDP2025-11-19
Web, Cloud
Medium
Bypass of Cloudflare's Cache Keys and WAF via header overflow
HackerOneCloudflare Public Bug Bounty2025-11-18
Web, Cloud
High
Low-privileged user can enable or disable Lovable AI for new projects in workspace
HackerOneLovable VDP2025-11-07
Web, AI
Low
Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable Cloud)
HackerOneLovable VDP2025-11-04
Web, Cloud
Low
Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable AI)
HackerOneLovable VDP2025-11-04
Web, AI
Low
Cookie exposure due to unexpected file permission change
HackerOnecurl2025-10-27
Web
Medium
Blu-ray Disc Java Sandbox Escape via two vulnerabilities
HackerOnePlayStation2025-10-18$5,000 bounty
Web
Medium
OneAgent Unprivileged NTLM User Coercion
HackerOneDynatrace2025-10-15$750 bounty
Windows
Medium
Showing the 150 most recent of 452. See all in the searchable index.
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.