Web, API
Not rated
BUG BOUNTY WRITEUPS
GraphQL writeups
GraphQL-specific bugs: introspection leaks, missing field-level authorization, batching attacks and injection through resolvers.
25 reports and writeups from 2024 to 2026. 11 carry a severity from the disclosing platform, 4 of them rated High or Critical. Last updated 2026-10-30.
Latest GraphQL reports
Search and filter all writeupsGraphQL Vulnerabilities: The Bug Class Most Hunters Still Don’t Know How to Test
Researcher blog2026-10-29
Web, API
Not rated
Web, API
Not rated
Web, API
Not rated
Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
HackerOneMozilla2026-08-05$12,000 bounty
Web, API
Critical
Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql
HackerOneHackerOne2026-06-17$7,000 bounty
Web, API
High
DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API
HackerOneHackerOne2026-04-16
Web, API
Not rated
Unauthenticated GraphQL access by prepending __schema to private operations
HackerOneEnjin2025-12-05$500 bounty
Web, API
Medium
GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)
HackerOneShopify2025-09-17
Web, API
Not rated
Insecure Direct Object Reference (IDOR) in GraphQL deleteProfileImages Mutation
HackerOneAutodesk2025-02-21
Web, API
High
Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`
HackerOneHackerOne2025-01-21$25,000 bounty
Web, API
Critical
Circular based introspetion Query leading to single request denial of service and cost consumption and query cost on api.sorare.com/graphql
HackerOneSorare2024-10-17
Web, API
Medium
RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention
HackerOneGitHub2024-09-17
Web, API, Source Code
Medium
Authorization bypass due to cache misconfiguration
Medium2024-08-21$2,000 bounty
Web, API
Not rated
The Butterfly Effect: Turning Overlooked - Misconfigurations into Zero Click Account Takeover
Researcher blog2024-08-07
Web, API
Not rated
Exploiting Broken Authentication Control In GraphQL
Researcher blog2024-07-24
Web, API, Cloud
Not rated
IDOR on HackerOne Embedded Submission Form
MediumHackerOne2024-06-19$2,500 bounty
Web, API
Not rated
Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint
HackerOneHackerOne2024-05-24
Web, API
Medium
IDOR - Leaking of team data (name, email, ID, member ID) via POST /api/v1/graphql `FetchMemberships` operation
HackerOneTools for Humanity2024-05-09$500 bounty
Web, API
Medium
Micro Services, Major Headaches: Detecting Vulnerabilities in Erxes' Microservices
Researcher blogErxes2024-03-21
Web, API, Source Code
Not rated
We Hacked Google A.I. for $50,000
Researcher blogGoogle2024-03-04$50,000 bounty
Web, API, AI
Not rated
Exploiting Kubernetes through Operator Injection
Researcher blog2024-02-13
Web, API, Cloud
Not rated
IDOR on GraphQL queries BillingDocumentDownload and BillDetails
HackerOneShopify2024-02-08$5,000 bounty
Web, API
Medium
RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention
HackerOneGitHub2024-01-12
Web, API, Source Code
Medium
Exploiting GraphQL
Researcher blog2024-01-03
Web, API
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.