Overview
The report's severity rating communicates the finding's risk level — the capstone of the report and the bug bounty path. This lesson covers severity in the report and consolidates report writing.
Learning objectives
- Explain stating severity in the report.
- Describe justifying severity consistently.
- Consolidate the report-writing module and the bug-bounty path.
Core concept
The report's severity states the finding's risk level (e.g. Critical/High/Medium/Low, often via CVSS), combining impact and likelihood/exploitability per the program's severity rules (from the program-scope module). A well-justified severity — grounded in the validated impact and the ease of exploitation — communicates the finding's priority and aligns with the program's reward structure. While the program makes the final severity determination during triage, providing an accurate, justified severity demonstrates understanding and helps set appropriate expectations. It is the culminating element that ties the report's impact and exploitability into a single risk rating.
How it works
The researcher assigns a severity based on impact (from the impact section, grounded in the safe demonstration) and likelihood/exploitability (how easily it can be exploited — preconditions), consistent with the program's severity rules and often computed via CVSS. They justify it briefly (why this impact and likelihood yield this rating). This gives triage a clear, reasoned priority. The program may adjust severity during triage (based on context the researcher may not see), but a well-reasoned severity shows professionalism and sets expectations. Severity, together with the title, summary, steps, impact, evidence, and remediation, completes a high-quality report — the deliverable that gets a finding understood, verified, prioritized, fixed, and rewarded.
Practical example
For the BOLA finding, the researcher rates it High/Critical, justifying: "Impact is high (any user can read all others' sensitive financial data — a broad confidentiality breach), and likelihood is high (trivially exploitable by any authenticated user changing a parameter), yielding a Critical severity." This reasoned rating, consistent with the program's rules, communicates the finding's priority. Combined with the clear title, summary, steps, impact, evidence, and remediation, it forms a complete, high-quality report — maximizing the chance the finding is verified, prioritized, fixed, and appropriately rewarded.
Cybersecurity relevance
Severity communicates a finding's priority and expected value, aligning with the program's reward structure — a well-justified severity (impact × likelihood, often CVSS) shows professionalism and sets expectations, though the program decides finally. It reflects the risk-based severity principles from the fundamentals, assessment, and reporting lessons. This severity element completes and consolidates writing a high-quality report — title, summary, steps, impact, evidence, remediation, severity — and with it the bug bounty path: authorized program participation, recon and discovery, safe vulnerability hunting and validation, and professional reporting. A high-quality report is what turns a discovered vulnerability into a verified, fixed, rewarded finding — the ultimate skill of a bug bounty researcher.
Common mistakes
- Inconsistent or unjustified severity not aligned with impact/likelihood or program rules.
- Over- or under-rating severity, misaligning with the actual risk and reward.
- Treating severity as the researcher's final call rather than a reasoned rating the program confirms.
Key takeaways
- Severity states the finding's risk (Critical→Low, often via CVSS), combining impact and likelihood/exploitability per the program's rules, with brief justification.
- It communicates priority and aligns with reward; the program makes the final determination, but a well-reasoned severity shows professionalism.
- Severity completes a high-quality report (title, summary, steps, impact, evidence, remediation, severity) and consolidates the bug-bounty path — turning a discovered vulnerability into a verified, fixed, rewarded finding.
Check your understanding
- How is a finding's severity determined and justified in a report, and who makes the final call?
- What are the elements of a high-quality bug bounty report, and why does report quality matter so much?