Bug bounty

This roundup covers ten bug bounty reports that HackerOne programs disclosed between 20 October and 10 November 2026. The recent 48 hour window was thin after the last several roundups, so the set widens to the past three weeks, skipping anything earlier roundups covered or that we could not confirm in both public archives we read. The ten span a wide range of bug classes: information disclosure, improper access control, code injection, cross-site scripting (scripting that runs attacker code in another user's browser), improper authentication, and plain business logic. None lists a bounty amount.

Two patterns tie the batch together. The first is the fix that did not finish the job: a Node.js patch that guarded one group of functions and left its siblings open, and a desktop client that re-opened a flaw two older advisories meant to close. The second is the gap between a backend that accepts anything and a frontend that cannot cope with it, which two Nextcloud reports turn into a data hiding attack. Every finding below is the named researcher's work, credited to their HackerOne handle, not ours.

Information disclosure: 120,000 consumer emails enumerable on an Essity loyalty site

matty69v found a WordPress loyalty site run by Essity whose 123,000 accounts mostly used the member's full email as their public display name, 98 percent of a 250-account sample. That name leaked unauthenticated through author page titles, the representational state transfer (REST) user listing, RSS feeds and Gravatar hashes, and because identifiers run in sequence, /?author=1 upward enumerates the whole database with no noindex. The result is a harvestable list of consumer emails for phishing and a likely data protection breach. The fix is to stop using emails as display names and authenticate the REST user endpoint. Program: Essity. Severity: critical. Reporter: matty69v. Report: https://hackerone.com/reports/3840113

Improper access control: dns.resolve in Node.js truncates names at a NUL byte

hasanfleyah reviewed the June 2026 fix for CVE-2026-48930 and found it incomplete: it rejected an embedded NUL byte (a zero character that ends a string in C) at dns.lookup but not at the dns.resolve* family the advisory title named. On patched Node.js v26.9.0, dns.resolve4('attacker.test\0.trusted.corp') returned an address, and a loopback server logged the query as only attacker.test. So code that suffix-checks a hostname then resolves it validates a different name than Node queries, defeating server-side request forgery (SSRF) allowlists and rebinding guards silently. The fix extends the NUL rejection to every resolve* call. Program: Node.js. Severity: high (CVSS 7.4). CVE: CVE-2026-105482. Reporter: hasanfleyah. Report: https://hackerone.com/reports/4038342

Code injection: a WordPress 7.1 media race writes a persistent PHP file

mappymappy123 reported this against the WordPress 7.1 development line before release; 7.0 is not affected. An Author, the default role above Contributor, wins a race between three REST media actions and image processing to drop a working PHP file. The chain finalizes attachment metadata to point original_image at an attacker-chosen .php name, fetches a remote image whose Content-Disposition header forces that name into the temporary directory, then races a post-process call so Imagick writes PHP-named derivatives. When /tmp is read-only and WordPress falls back inside wp-content, a surviving .php derivative runs on request, giving Author-to-code-execution. The fix stops the download trusting a remote filename. Program: WordPress. Severity: high. Reporter: mappymappy123. Report: https://hackerone.com/reports/3923967

Improper access control: a HEY user can send signed mail as any @hey.com address

gachikuku showed that an ordinary HEY user, on the Basecamp email service, can make HEY send mail from an address that is not theirs. The flow registers an attacker-chosen @hey.com sender with unrelated outbound mail (SMTP) credentials, enqueues a message as that identity, then deletes the temporary external account about 0.8 seconds later, before dispatch. With it gone, HEY delivers through its own infrastructure but keeps the claimed identity, so recipients got mail from The HEY Team <support@hey.com> passing the SPF, DKIM and DMARC sender-authentication checks. The fix is to refuse any @hey.com sender the account does not own and cancel such fallback delivery. Program: Basecamp. Severity: high (CVSS 7.0). Reporter: gachikuku. Report: https://hackerone.com/reports/4035023

Cross-site scripting: a WordPress Quick Edit reparses a Contributor name into live HTML

mappymappy123 also found stored cross-site scripting in WordPress 7.0.2 that only fires on sites with over 10,000 users. A Contributor sets their display name to an entity-encoded payload like <img src=x onerror=...>, stored and shown safely as text. On a large site Quick Edit drops its author dropdown and takes a fallback that reads the cell with .text() and feeds it to .prepend(), decoding the entities into a live img tag that runs when an administrator opens a crafted Posts URL and clicks Quick Edit. The reporter chained it to a request that creates a new administrator, a full takeover from one admin click. The fix keeps that value as text. Program: WordPress. Severity: medium. Reporter: mappymappy123. Report: https://hackerone.com/reports/3878399

Code injection: Nextcloud desktop loads an unsigned library from a mountable path

the_xcheater reported that a standard macOS user can inject code into the Nextcloud desktop client's web renderer, the subprocess handling embedded web content and sign-in. In version 33.0.5 it disables Apple's library validation, so it loads a dynamic library whose signature does not match the developer, and it carries a dead build-server path under /Volumes/builds ahead of the real app folder in its search order. A standard user can mount a disk image at /Volumes without admin rights, plant a library there, and launch the renderer, which runs the attacker's code with access to the keychain and synced files. The fix removes the stale path and keeps validation on. Program: Nextcloud. Severity: low (CVSS 3.6). Reporter: the_xcheater. Report: https://hackerone.com/reports/3772818

Business logic: an invalid icon name hides a whole Nextcloud Tables application

khoof found that the Nextcloud Tables app accepts any string in the iconName field when a user with edit access updates an application. The backend stores a nonsense value and answers 200 OK, but the frontend throws while rendering the unknown icon and the whole application card fails to load, so to everyone sharing it the tables, records and settings vanish with no error, though the data survives in the database. Any user with edit rights can trigger it with one API request, a quiet sabotage lever. The fix is to validate iconName on the server and fall back to a default icon on the client. Program: Nextcloud. Severity: low (CVSS 3.5). Reporter: khoof. Report: https://hackerone.com/reports/3508852

Improper authentication: cross-room signaling force-mutes a Nextcloud Talk user

brumbelow showed that a normal Nextcloud Talk participant can inject moderator-only control messages into another participant's session. The participant list exposes each attendee's live session identifier, and the signaling controller checks moderator rights only against the sender's own room while queuing the message to any recipient session named, keyed on that recipient alone. The reporter read a victim's session from a shared room, then used moderator rights in a separate room they owned to send a forceMute that the victim's next poll picked up and the client obeyed. The lesson is that routing must enforce the room boundary, not just the sender's local permission. Program: Nextcloud. Severity: low (CVSS 3.3). CVE: CVE-2026-45266. Reporter: brumbelow. Report: https://hackerone.com/reports/3636758

Business logic: an invalid tag colour breaks a Nextcloud Deck board

khoof filed a close cousin of the Tables bug against the Nextcloud Deck app. Creating a label sends a color field meant to hold a predefined or valid hex colour, but the server validates nothing and accepts an arbitrary string with a 200 OK. Once stored, that label stops the board's tag section rendering and its management panel opening, for every board member, until someone cleans the record, and any user with board access can cause it. Like the icon bug, it is a permissive backend meeting a frontend that assumes well-formed data; the fix is to validate the colour on the server and reject bad input with a 4xx response. Program: Nextcloud. Severity: low (CVSS 2.7). Reporter: khoof. Report: https://hackerone.com/reports/3485178

Information exposure: a Weblate wlc download leaves stale archives and leaks local paths

sumit-sabhaya reported two related gaps in wlc, the Weblate command-line client, in release 2.2.0 and the main branch. A project-wide download writes one archive per component; if a later one fails after earlier ones succeed, the finished archives stay on disk and the command exits 1 without saying which were written, so automation that publishes the directory cannot tell a complete result from a partial one and may reuse stale bundles. Separately, uncaught filesystem errors print a full Python traceback that leaks the operator's absolute paths and username into stderr, where continuous integration logs keep it. The fix is to catch the error, validate the output path first, and report which files were written. Program: Weblate. Severity: low. Reporter: sumit-sabhaya. Report: https://hackerone.com/reports/4040149

What to take from this batch

When a fix names a problem, test its siblings: the Node.js NUL bug slipped through because the guard landed on dns.lookup, not the dns.resolve* family the advisory title called out. Test the seams between layers too, where one side accepts input the other cannot handle, from a backend that stores any icon name to a mail service that keeps an identity after its authorization is gone.

Our web application penetration testing works through enumeration, signup and authorization flows like the Essity and HEY reports, and red team code review reads source for incomplete fixes and missing input checks like the Node.js and Nextcloud bugs. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Individual reports on HackerOne: https://hackerone.com/reports/3840113, https://hackerone.com/reports/4038342, https://hackerone.com/reports/3923967, https://hackerone.com/reports/4035023, https://hackerone.com/reports/3878399, https://hackerone.com/reports/3772818, https://hackerone.com/reports/3508852, https://hackerone.com/reports/3636758, https://hackerone.com/reports/3485178, https://hackerone.com/reports/4040149. Archives used for ranking and detail: https://github.com/ajaysenr/HackerOne-Disclosed-Reports and https://github.com/Gh0stSpy/HackerOne-Disclosed-Reports-Database