Basecamp Program Statistics

View program

50 total issues disclosed

$50,860 total paid publicly

Most disclosed (5 disclosures) — Improper Authentication - Generic

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass Cross-site Scripting (XSS) - Stored newbiefromcoma Low 2026-07-14
Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity Improper Access Control - Generic zerodaysec_xyz Medium 2026-07-04
DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover Cross-site Scripting (XSS) - DOM xavlimsg High 2026-04-14
Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure Improper Access Control - Generic xavlimsg Low 2026-04-14
Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure Insecure Direct Object Reference (IDOR) perxibes Low 2026-03-16
Spam & Clearance checks disabled with existing referenced Message-ID Improper Access Control - Generic northeastprince Low 2026-01-21
Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addresses Server-Side Request Forgery (SSRF) brumbelow Medium 2025-12-22
Improper bot-authentication allows to impersonate any user when sending messages in a room Improper Authentication - Generic stackered High 2025-11-21
Two click Account Takeover Deserialization of Untrusted Data fr4via High 2025-11-11
Mutation Based Stored XSS on Trix Editor version latest (2.1.8) None supplied sudi Critical 2025-06-27
Critical Data Breach - Big Data for all domains None supplied shezxi Medium 2025-01-14
Stored XSS on trix editor version 2.1.1 Cross-site Scripting (XSS) - Stored thwin_htet High 2024-11-04
Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click) Path Traversal fr4via Medium 2024-07-09
Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com Deserialization of Untrusted Data fr4via Medium 2024-07-09
Account takeover via insecure intent handling Deserialization of Untrusted Data fr4via Medium 2024-05-30
AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp Information Disclosure neex High 2023-09-21
Arbitrary write in the application's data folder and arbitrary read of server's replies from 3rd party apps. Path Traversal fr4via High 2023-06-07
com.basecamp.bc3 Webview Javascript Injection and JS bridge takeover Cross-site Scripting (XSS) - DOM fr4via High 2022-09-23
RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.com Deserialization of Untrusted Data ian Low 2022-04-26
Able to steal bearer token from deep link Improper Authentication - Generic danielllewellyn High 2022-03-27
Improper Authentication via previous backup code login Improper Authentication - Generic fuzzsqlb0f Medium 2022-03-24
Privilege Escalation leads to trash other users comment without having admin rights. Privilege Escalation fuzzsqlb0f Low 2021-12-01
Privilege Escalation leads to trash other users comment without having admin rights. Privilege Escalation fuzzsqlb0f Low 2021-12-01
Subdomain Takeover due to ████████ NS records at us-east4.37signals.com Information Disclosure nagli Medium 2021-09-17
HTTP Request Smuggling via HTTP/2 HTTP Request Smuggling neex Critical 2021-08-27
Domain Takeover [3737signals.com] Phishing mrmax4o4 Low 2021-08-13
Insecure Bundler configuration fetching internal Gems (okra) from Rubygems.org Command Injection - Generic zofrex High 2021-08-10
Password reset link not expiring after changing password in settings Improper Authentication - Generic blackbibin Low 2021-08-10
Login session not expire Insufficient Session Expiration blackbibin Low 2021-08-10
Information Disclosure .htaccess accesible for public None supplied alone_breecher Low 2021-07-18
Error Page Content Spoofing or Text Injection Violation of Secure Design Principles princej_76 Low 2021-07-14
Lack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCE None supplied hensis Medium 2021-04-22
User can upload files even after closing his account Improper Authentication - Generic h4x0r_dz No rating 2021-03-29
DNS Setup allows sending mail on behalf of other customers Violation of Secure Design Principles aisforarray Medium 2021-02-21
Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source. None supplied demonia Medium 2020-12-17
Information Disclosure of Garbage Collection Cycle 'Again' Information Disclosure jerry3 Low 2020-12-16
Premium Email Address Check Bypass - Hey Business Logic Errors ok_bye_now Medium 2020-12-15
SSL expired subdomain leads to API swap with main and flagged cookies. Unable to log device ids and certain session tokens. Improper Restriction of Authentication Attempts babykeem Medium 2020-12-03
Bypass of image rewriting / tracking blocker via srcset Information Disclosure foobar7 Medium 2020-12-03
Remote code execution on Basecamp.com Command Injection - Generic gammarex Critical 2020-11-26
Attachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket) Business Logic Errors hudmi High 2020-11-26
Remote Code Execution in Basecamp Windows Electron App Code Injection co0sin High 2020-11-19
a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of service Denial of Service tw4v3sx Medium 2020-11-10
Information Disclosure of Garbage Collection Cycle Information Disclosure ahmd_halabi Low 2020-11-04
stored XSS in hey.com message content Cross-site Scripting (XSS) - Stored carbon61 Medium 2020-10-31
CSRF on launchpad.37signals.com OAuth2 authorization endpoint Cross-Site Request Forgery (CSRF) carbon61 High 2020-10-30
Unauthenticated request smuggling on launchpad.37signals.com HTTP Request Smuggling hazimaslam Critical 2020-10-28
HTTP request smuggling on Basecamp 2 allows web cache poisoning HTTP Request Smuggling hazimaslam Critical 2020-10-28
HEY.com email stored XSS Cross-site Scripting (XSS) - Stored jouko Critical 2020-10-27
Possible DOM XSS on app.hey.com Cross-site Scripting (XSS) - DOM enigmaticjohn High 2020-10-27