HackerOne Disclosed Reports - 2026-08-03

Low
resolved

GitHub Retired UsernameTakeover From [aws/████████]

Bug reported by Shad0w was disclosed at August 3, 2026, 6:17 pm   |   Inclusion of Functionality from Untrusted Control Sphere

A retired GitHub username was discovered to be unclaimed, allowing an attacker to register the username and create a repository with the same name as the original. As a result, the original link to the repository now points to the attacker-controlled repository, enabling a persistent repository hijack.

High
resolved

Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage

Bug reported by s was disclosed at August 3, 2026, 1:35 pm   |   Path Traversal