地图 / 访问控制缺陷（通用）

访问控制缺陷（通用）

Improper Access Control - Generic · 访问控制

访问控制 / 访问控制缺陷（通用）

772公开报告

—CWE 编号

0已标注发现方式

772关联报告

发现方式分布

暂无发现方式标注。

关联报告

Account Takeover via Password Reset without user interactionsGitLab · 2025-02-26 · 高危 · $35,000 · 989 票 Exfiltrate and mutate repository and project data through injected templated serviceGitLab · 2019-03-05 · 高危 · $11,000 · 762 票 Getting all the CD keys of any gameValve · 2018-10-31 · 高危 · $20,000 · 638 票 Ability to reset password for accountUpserve · 2019-06-06 · 高危 · 637 票 Publicly accessible Continuous Integration ToolSnapchat · 2021-07-29 · 高危 · 562 票 One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · 2022-08-02 · 高危 · 509 票 Reset password link sent over unsecured http protocolMattermost · 2023-05-10 · 中危 · $750 · 440 票 Full account takeoverReverb.com · 2020-03-19 · 中危 · 412 票 Cross-organization data access in city-mobil.ruMail.ru · — · 未评级 · $8,000 · 374 票 Attacker is able to access commit title and team member comments which are supposed to be privateGitLab · 2019-07-03 · 中危 · 351 票 Private list members disclosure via GraphQLX / xAI · 2020-08-04 · 低危 · 346 票 [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious FileMail.ru · — · 未评级 · 340 票 Exposed proxy allows to access internal reddit domainsReddit · 2025-02-24 · 中危 · $7,500 · 296 票 [CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/startRemitly · 2025-07-21 · 高危 · 291 票 Organization TakeoverHelium · 2020-05-27 · 中危 · $500 · 263 票 View Titles of Private Reports with pending email invitationHackerOne · 2024-01-16 · 中危 · 257 票 Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgStarbucks · 2020-12-09 · 高危 · 247 票 Shopify Partners Invitation Process Allows Privilege Escalation Without Email VerificationShopify · 2025-05-15 · 低危 · 245 票 Account takeover of existing HackerOne accounts through SCIM provisioningHackerOne · 2025-07-17 · 中危 · 232 票 1 Click Account Takeover via Auth Token Theft on marketing.hostinger.comhostinger · 2025-06-06 · 中危 · 219 票 Discoverability by phone number/email restriction bypassX / xAI · 2022-02-11 · 中危 · $5,040 · 217 票 Group search leaks private MRs, code, commitsGitLab · 2019-12-14 · 中危 · 212 票 Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Uber · 2021-03-06 · 低危 · $4,500 · 210 票 Able to bypass email verification and change email to any other user emailReddit · 2022-05-06 · 中危 · $5,000 · 200 票 Admin Management - Login Using Default Password - Leads to Image Upload Backdoor/ShellRazer · — · 未评级 · $200 · 199 票 Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiGitHub · 2023-01-26 · 中危 · 198 票 Verify any unused email addressX / xAI · 2019-06-24 · 未评级 · $560 · 197 票 SAML Signature verification bypass allows logging into any user (with specific conditions)GitHub · 2024-10-10 · 高危 · 196 票 Through blocking the redirect in /* the attacker able to bypass Authentication To see Sensitive Data sush as Game Keys , Emails ,..Razer · — · 未评级 · $1,000 · 196 票 Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Reddit · 2022-11-14 · 中危 · 186 票 SOP bypass using browser cacheKeybase · — · 未评级 · 185 票 Authentication bypass on gist.github.com through SSH CertificatesGitHub · 2023-04-20 · 中危 · $10,000 · 182 票 Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.comShopify · 2025-03-20 · 低危 · 181 票 Previously created sessions continue being valid after MFA activationSuperhuman (formerly Grammarly) · 2019-08-19 · 低危 · 176 票 1 click Account takeover via deeplink in [com.kayak.android]KAYAK · 2023-01-19 · 高危 · 173 票 IDOR in the https://market.semrush.com/Semrush · 2020-04-30 · 高危 · 173 票 User can delete data in shared folders he's not autorized to accessNextcloud · 2020-04-10 · 低危 · 173 票 [IDOR] API endpoint leaking sensitive user informationRazer · — · 未评级 · $375 · 172 票 Misconfigured s3 Bucket exposureRazer · — · 未评级 · $500 · 168 票 Undocumented `fileCopy` GraphQL APIShopify · 2020-10-22 · 低危 · $2,000 · 157 票 CRITICAL ISSUE : Leak of all accounts mail login md5 pass and morePornhub · — · 未评级 · 157 票 Can delete other user's post and company page postLinkedIn · 2023-04-11 · 未评级 · 156 票 Access to TarantoolMail.ru · — · 未评级 · $4,000 · 155 票 Access to the business emails of Rockstar Support agents through the support platformRockstar Games · 2025-10-02 · 低危 · $550 · 151 票 Banned user still has access to their deleted account via HackerOne's API using their API keyHackerOne · 2025-07-14 · 低危 · 150 票 [ Spot Check ] Team members can edit a user's write-upHackerOne · 2024-06-06 · 低危 · 149 票 [mcs.mail.ru] Пользователь с ролью наблюдателя может создавать ключи доступа для очереди сообщений (sqs.mcs.mail.ru)Mail.ru · — · 未评级 · $15,000 · 147 票 User with removed manage shops permissions is still able to make changes to a shopShopify · 2020-06-12 · 低危 · 145 票 Bug in GraphQL and API integration leads to limited user address disclosureStarbucks · 2019-03-08 · 中危 · 144 票 Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.milU.S. Dept Of Defense · 2025-02-12 · 高危 · 142 票 Ticket Trick at https://account.acronis.comAcronis · 2020-11-10 · 中危 · 142 票 [Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.Stripo Inc · 2026-01-20 · 高危 · 140 票 Unauthenticated users can access all food.grammarly.io user's dataSuperhuman (formerly Grammarly) · 2020-08-10 · 低危 · 138 票 Create free Shopify application credits.Shopify · 2021-09-10 · 低危 · 134 票 Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH)Superhuman (formerly Grammarly) · 2020-01-04 · 中危 · $800 · 134 票 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationKhan Academy · 2026-06-20 · 高危 · 126 票 Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License AbuseHackerOne · 2026-03-18 · 低危 · 126 票 Ability to access policy and updates for unauthorized programHackerOne · 2025-05-08 · 低危 · 124 票 Spam & Clearance checks disabled with existing referenced Message-IDBasecamp · 2026-01-21 · 低危 · $250 · 123 票 RCE/LFI on test Jenkins instance due to improper authentication flowSnapchat · 2017-08-19 · 低危 · 118 票 Object Level access control leads to reading user's full requests, sessions, and error messagesYelp · 2025-01-18 · 低危 · 113 票 [www.zomato.com] Leaking Email Addresses of merchants via reset password featureEternal · 2021-02-18 · 未评级 · 113 票 Previous commentor on post can still comment even after comment permission is changed to disabledLinkedIn · 2026-02-03 · 低危 · 112 票 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csvHackerOne · 2024-06-20 · 低危 · $500 · 111 票 Access to Employee calendar disclosing internal presentation and meetingsShopify · 2019-03-08 · 低危 · $1,000 · 111 票 Facebook Username Takeover via Broken Link in FooterOmise · 2025-05-30 · 低危 · 110 票 No rate limiting on form[register]Informatica · — · 未评级 · 109 票 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure ReportsHackerOne · 2024-06-17 · 中危 · 109 票 Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.phpShopify · 2022-08-11 · 低危 · $2,900 · 109 票 Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Acronis · 2022-02-08 · 低危 · 109 票 ISteamAssets gives partners control over unrelated community market transactionsValve · 2019-05-23 · 中危 · 109 票 Banned user still able to invited to reports as a collabrator and reset the passwordHackerOne · 2023-07-06 · 低危 · 107 票 2FA requirement bypass when inviting team membersOmise · 2026-02-28 · 低危 · 105 票 connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invites8x8 · 2023-02-15 · 中危 · 105 票 Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivityBasecamp · 2026-07-04 · 低危 · 104 票 Program Member Could Duplicate Report To A Non Related Program Original ReportHackerOne · 2024-06-19 · 中危 · 104 票 IDOR allowing to read another user's token on the Social Media Ads serviceSemrush · 2022-08-16 · 中危 · 104 票 User account compromised authentication bypass via oauth token impersonationPicsart · 2020-03-20 · 中危 · 101 票 Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)Nextcloud · 2026-05-21 · 低危 · $150 · 100 票 Improper Access Control - Access to "Active Hiring" (Premium feature) filter resultsLinkedIn · 2026-02-03 · 低危 · 100 票 Group search with Elastic search enable leaks unrelated dataGitLab · 2019-12-14 · 中危 · 100 票 [Hubs] - Broken access control in placing objects in hubs roomMozilla · 2023-07-20 · 低危 · 99 票 [h1-415 2020] Spent a week and failed at solving the last step.h1-ctf · 2020-02-04 · 高危 · 99 票 Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication.Starbucks · 2019-11-19 · 低危 · 99 票 Github app Privilege Escalation to Administrator/Owner of the OrganizationGitHub · 2023-01-13 · 中危 · 98 票 Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirectX / xAI · 2019-04-29 · 高危 · 95 票 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewedHackerOne · 2024-01-04 · 低危 · 93 票 Open Selenoid instance at 188.93.63.186 leads to LFR/SSRF.Mail.ru · — · 未评级 · $6,000 · 93 票 Privilege Persistence via Cloned AgentDust · 2025-04-30 · 低危 · 91 票 Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpointX / xAI · 2024-03-01 · 低危 · 91 票 Missing Line Terminator on allowedOrigins enables origin spoofingMetaMask · 2024-10-29 · 中危 · 90 票 GitHub Apps can access suspended installations via scoped user-to-server tokensGitHub · 2024-07-31 · 低危 · 90 票 Session Doesn't expire after 2fa and also other session can change passswordSideFX · 2024-03-02 · 低危 · $300 · 90 票 Support Portal Takeover via Leaked API KEYAMBER AI · — · 未评级 · $1,500 · 90 票 Ability to publish a paid theme without purchasing it.Shopify · 2020-08-27 · 低危 · $2,000 · 90 票 RepositoryPipeline allows importing of local git reposGitLab · 2022-11-04 · 低危 · $22,300 · 89 票 Add new development stores without permissionShopify · 2021-06-04 · 低危 · 89 票 Improper Access Controls(Admin Path)MTN Group · 2025-01-31 · 中危 · 88 票 User automatically logged in as Sys Admin user on https://███/Administration/Administration.aspxU.S. Dept Of Defense · 2023-11-03 · 高危 · 88 票 Access to microtransaction sales data for lots of apps from 2014 to present at /valvefinance/sanity/Valve · 2021-09-21 · 高危 · 88 票

查看全部 772 份报告 →