Post cover image

August 23, 2026

I Ranked 252 Disclosed IDOR Reports by Bounty. Severity Barely Mattered.

A CVSS 5.3 IDOR paid $5,000. A CVSS 9.0 account takeover paid nothing. I pulled the full records behind both — and 250 more — to see what…

By Raj Namdev

6 min read

A CVSS 5.3 IDOR paid $5,000. A CVSS 9.0 account takeover paid nothing. I pulled the full records behind both — and 250 more — to see what the money actually follows.

Report #2207248 leaked other Shopify merchants' billing documents through a GraphQL API: email, full address, invoice contents, last four digits of the card and its type. Severity field says Medium. CVSS 5.3. Bounty: $5,000.

Report #876300 was a full account takeover on Starbucks Singapore, through an IDOR. Severity field says Critical. CVSS 9.0. Bounty line: empty.

Same platform type. Same vulnerability class. The one with nearly double the CVSS paid nothing.

If that pairing irritates you — you've had a "high" IDOR come back $50, or informative, and been told the score is the score — the explanation is sitting in the data. It just isn't sitting in the severity field.

What I Actually Ranked

The base is the community dataset at reddelexc/hackerone-reports, which tracks disclosed HackerOne reports by bug type. The IDOR list holds 252 of them, with program, title, upvotes, and bounty. No dates, no severity — so I pulled the live JSON behind the reports that define the extremes: the top of the money list, and the famous zeros. A dozen full records with severity, state, and where the disclosure allows it, the original writeup.

The headline numbers first. Of 252 disclosed IDOR reports, 53 paid anything. 199 paid nothing. Every IDOR bounty in the dataset adds up to $57,735 — and a single report, PayPal's, is $10,500 of that. One bug holding 18 cents of every dollar the entire class ever earned here.

Now the part that made me pull severity ratings one by one.

The Criticals That Paid Nothing

Every report below is live, and every number comes from its own JSON — not from anyone's writeup about it.

The ones that paid:

#415081 — PayPal
→ Add yourself to any business account
→ High, 7.1 → $10,500
#2207248 — Shopify
→ Read any merchant's billing documents
→ Medium, 5.3 → $5,000
#1658418 — Reddit
→ Read mod logs, any subreddit
→ High → $5,000
#1966006 — Unikrn
→ Enumerate cashier email + phone
→ High → $3,000
#1392630 — TikTok
→ Read any seller's support tickets
→ Medium, 6.5 → $2,500
#1410498 — Judge.me
→ Leak buyer info, edit comments
→ High, 7.5 → $1,250

The ones that paid nothing:

#2122671 — HackerOne
→ Delete every user's certifications
→ High, 7.5 → $0
#1969141 — HackerOne
→ Delete other users' campaigns
→ High, 8.3 → $0
#876300 — Starbucks
→ Full account takeover
→ Critical, 9.0 → $0
#915114 — Automattic
→ Account takeover, zero interaction
→ Critical → $0
#1272478 — MTN
→ Account takeover, zero interaction
→ Critical → $0

Read the bottom three rows again. Three Criticals — two of them full account takeovers needing no victim interaction — and $0 between them. The two Mediums above them collected $7,500 combined.

Before screenshotting this for r/bugbounty: the three Criticals have something in common, and it's the first real finding in the data. Starbucks, Automattic, and MTN weren't paying cash for these reports at all. The severity was right. The wallet was closed.

The Floor Comes Before the Score

The cleanest demonstration of the program effect is a pair of reports with word-for-word identical titles: "IDOR to view order information of users and personal information." One is on Affirm — rated Medium, paid $500. The other is on WakaTime — paid nothing, per the dataset. Same bug. Same title, literally. The only variable that changed was who was holding the checkbook.

That's the floor. It gets set before triage reads a word of your report, and no severity argument moves it. A chunk of those 199 zeros are exactly this: solid findings on programs that pay in thanks, or swag, or nothing at all. Disclosed-report datasets skew toward big-name programs, so the skew here is real but not random — and nothing in your report fixes it. Reading the bounty table before the first request is the only move that does.

Everything above the floor, though — that part actually responds. Just not to CVSS.

Above the Floor, the Money Follows the Data

Sort the paid reports by what they actually touched, and a gradient falls straight out.

At the top: money-adjacent data. Shopify's $5,000 Medium was invoices and card fragments — the billing record itself. Unikrn's $3,000 was an email and phone number, which sounds unremarkable until you see where they lived: inside the cashier. The same fields sitting on a profile page would have been a completely different conversation.

Next tier: other people's privileged internals. Reddit paid $5,000 for mod logs — the actions moderators take inside restricted subreddits, visible to anyone who changed the subredditName argument in one GraphQL call to gql.reddit.com, because nothing checked whether the requester actually moderated that subreddit. TikTok paid $2,500 for support tickets. Judge.me paid $1,250 for buyer info plus the ability to hide and publish other shops' comments — read plus write.

The zero tier, for contrast, runs long and is full of profile trivia: unpinned achievement badges, folder names, newsletter unsubscriptions, profile photos. Real bugs. Wrong data.

The pattern isn't subtle. Financial context beats identity context beats content beats decoration. And the action ladder runs read < write < delete on otherwise-equal data — with one towering exception sitting right at the top of the list.

The Report Is a Severity Input — the Platform Says So

Here's the mechanism, and it isn't folk wisdom from the subreddit. HackerOne's Detailed Platform Standards — the IDOR section updated in January 2026 — instruct programs to start with CVSS and then apply "bumps" for discrepancies between the rating and the actual business impact. Two of those rules hand the outcome directly to what your report demonstrates.

The UUID discount. An IDOR sitting behind unpredictable identifiers — UUIDs, hashes — defaults to Attack Complexity: High, which drags the score down. That discount only lifts if the report shows a reliable way to obtain the IDs: leaked elsewhere in the application, in API responses, HTML source, error messages, or following an observable pattern. Same endpoint, same bug — but the report proving acquisition scores higher than the one that just says "I got lucky with one ID." This is a scoring rule, not a style preference.

HackerOne's own platform provided the textbook case for the other branch of that rule. Report #2122671 — the certifications deletion — states in its public writeup that changing the ID from one to a possible range lets you delete every user's certifications in between. Sequential integer IDs, enumerable by range. The report demonstrates acquisition exactly the way the standard asks for. It still paid nothing, because it was filed on HackerOne's own program. On any paying program, that same demonstration is worth a full severity tier before a triager types a single word back.

The PII override. Sensitive PII — the standard names social security numbers, passports, hashed passwords, card numbers, physical addresses, dates of birth — readable by an unprivileged attacker across multiple users, at scale, over the internet: Critical, regardless of CVSS. That's the rule that turned Shopify's 5.3 into a $5,000 payout conversation. The score said Medium. The data on the page said billing records, so the program paid a Critical-shaped number anyway.

Two smaller notes from the same document, both worth real money. Chains are valued on their overall impact — which is the entire story of the PayPal report at the top of this list, and it's worth coming back to. And data deletion counts as Integrity impact, not Availability — a delete-IDOR report claiming availability impact is arguing from the wrong axis, and triage notices immediately.

One more thing the standard asks for, reading like fine print but isn't: the moment a finding exposes sensitive PII, testing stops. The report that says "I stopped here, per platform guidance, and here is exactly how far the access reaches" is both safer and stronger. Scale is a severity input now. Proving you can enumerate is the impact — actually enumerating past that point isn't necessary and isn't safe.

The Next IDOR You Find

Run the sequence in order, because the order is the finding:

1. Check the bounty table before the first request —
   the floor is real, and it's the biggest number in
   this entire dataset.
2. Name the data against the PII list, not the endpoint —
   an endpoint name has never paid anybody.
3. Count who's reachable, and say plainly where you
   stopped once the answer got uncomfortable.
4. Prove how the IDs are actually obtained — leaked,
   patterned, whatever the mechanism is — because that
   single paragraph is what lifts the Attack Complexity
   discount.
5. Follow the chain one step past the object you can
   touch, because chains get priced on where they end,
   not where they start.

Why the Top of the List Is the Top of the List

The highest-paying IDOR in all 252 reports — 791 upvotes, $10,500 — stole nothing. Leaked nothing. Deleted nothing. The writeup isn't public; the title is: "IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/users." It added a user to a business account.

CVSS scored that 7.1. The bounty table scored it $10,500, because what a secondary user on a PayPal business account can go on to do next is where the money actually lives. Between those two numbers sits the entire distance this dataset measures.

Sources

  • Dataset: reddelexc/hackerone-reports — TOPIDOR list, 252 disclosed reports. Bounty totals and the 53/199 split computed directly from it; severity ratings pulled from each cited report's live JSON. All report links verified resolving.
  • HackerOne Detailed Platform Standards — impact bumps over CVSS, the IDOR Attack Complexity rule, the sensitive PII Critical override, chain valuation, deletion-as-Integrity, stop-testing guidance.
  • "High Severity IDOR Vulnerability Marked as Informative" — r/bugbounty — the recurring community version of the severity/payout gap.
  • "How I made $6,000 from an IDOR Vulnerability (Informative → High Severity)" — a documented appeal win demonstrating the same gap in practice.
  • Reports cited inline: #415081, #2207248, #1658418, #1966006, #1392630, #1410498, #2122671, #1969141, #876300, #915114, #1272478.