Matomo

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (official latest.zip release on a typical server) │ $13,000 │ $14,000 High (including super-user-only RCE, demoted from Critical by rule) │ $1,777 │ $2,221 Medium │ $777 │ $971 Low │ $333 │ $416 Submit a vulnerability CVE history 0 Last 12 months 23 Lifetime Code execution 30 % XSS 25 % Injection 20 % Access control 20 % Latest advisories Loading the feed Overview Matomo is the self-hosted analytics platform organisations run when they want the open alternative to Google Analytics and want the visitor data to stay on their own servers. The program's scope statement is the cleanest self-hosted one anywhere: the target is the official release build at builds.matomo.org/latest.zip as installed on a typical server, plus the first-party plugins by Matomo and InnoCraft, the official Docker image, the rest of the matomo-org and innocraft GitHub organisations, and Matomo Cloud: the hosted product is one asset among seven rather than the headline. That means a bug in the downloadable code is the main event here, not an afterthought. InnoCraft pays a valid Critical at $13,000, with High at $1,777 (and super-user-only RCE explicitly demoted to that rung), and the program is a fast one in practice, 320 reports resolved at 99% response efficiency. sorona.xyz adds 1.25× on top of whatever InnoCraft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~13 hours First response ~13 hours Triage ~4 days Bounty In scope The program's own definition of the target: an issue in the latest official release at builds.matomo.org/latest.zip as installed on a typical server, possibly using any official plugin by Matomo or InnoCraft from the Marketplace. The matomo-org/matomo source-code asset carries that at Critical severity That release in full, meaning the whole application: the tracking endpoint every measured site posts to, the reporting API, the web UI and the administration area The multi-site and user-permission model: sites, users, roles, auth tokens, and every check meant to keep one site's analytics away from another's Authentication and session handling as shipped, including the login, password reset and two-factor flows The plugin machinery itself, together with the official first-party plugins by Matomo and InnoCraft, premium ones included, which the program prices at Critical through the plugins.matomo.org/developer asset rows The archiving and cron pipeline, the import and export paths, and the installer and updater that run against a live database The official Docker project at github.com/matomo-org/docker, a Critical-severity asset in its own right Everything else under the matomo-org and innocraft GitHub organisations, bounty-eligible but capped at High Matomo Cloud on the per-account *.matomo.cloud subdomains, tested on an instance you set up yourself, without automated tooling and without disturbing a live one Out of scope Third-party Marketplace plugins written by anyone other than Matomo or InnoCraft, which pay nothing regardless of severity. This is the exclusion that most changes a researcher's expected value The project's own web properties: matomo.org, api.matomo.org, shop.matomo.org, and plugins.matomo.org as a platform, as opposed to the first-party plugins it distributes forum.matomo.org, which runs Discourse and belongs on Discourse's own bug bounty rather than this one The Matomo Mobile 2 Android and iOS apps, which are not bounty-eligible at all and take only critical issues compromising the token Anything already fixed in the code, even where the fix has not yet shipped in a release Findings derived only from code reading, scanners, or AI output with no reproduction on a running instance Critical-band claims anywhere outside matomo-org/matomo, the official Docker project and the two official plugin developer accounts, since the rest of both organisations caps at High Most-valued findings Remote code execution on a default install reachable without super-user rights, the only shape that holds the full $13,000, since super-user-only RCE drops by rule to the $1,777 rung, and code execution is the largest expected class at 30% SQL injection through the tracking or reporting API, the surface where Matomo takes input from every website it measures Stored XSS in a report, segment, annotation or site setting that fires in a higher-privileged user's session and escalates to admin Access-control failure that lets one user read or write another site's analytics data across the multi-site boundary The same classes inside a first-party Matomo or InnoCraft plugin, which pay at the full rate while third-party plugins pay nothing at all Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Findings must be validated in a real, running Matomo instance; reports based solely on reading the code are closed Reports based on automated tools or AI-generated output without demonstrated exploitability are not accepted Vulnerabilities already fixed in code do not qualify even if the fix has not yet landed in a release, so racing a maintainer's commit loses the bounty Super-user-only RCE is downgraded from Critical to High by explicit rule, which is the whole $13,000 versus $1,777 boundary On matomo.cloud, keep tests to ones that do not affect the live instance and do not point automated tools at it: set up your own instance instead Payment is made by PayPal or through HackerOne Program stats 320 Reports resolved $155k Bounties paid 99% Response efficiency Disclosure Coordinated through Matomo. The policy asks for a reasonable amount of time to resolve the issue before any disclosure to the public or a third party, and does not bound that with a number of days, so publication waits on the fix reaching a release. It is a softer clause than most on this list, there is no perpetual gag and no IP assignment, but sorona.xyz still holds your finding until Matomo has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability