Cbre Australia Vulnerability Disclosure

generated: '2026-07-26'
method: searched
source: https://www.cbre.com/about-us/corporate-responsibility/vulnerability-disclosure
scope_note: >-
  CBRE Group operates a single, global Responsible Disclosure Program. There is no
  separate Australian program, and no security.txt is published on cbre.com.au or
  cbre.com. The program below is the parent-company program that covers CBRE
  Australia's estate; it is a vulnerability disclosure program (VDP), not a public
  bug bounty.
program:
  name: CBRE Responsible Disclosure Program
  type: vulnerability-disclosure
  platform: HackerOne
  bounty: false
  bounty_note: >-
    "CBRE's public vulnerability disclosure program does not offer a reward or
    compensation for sharing potential security vulnerabilities." CBRE separately
    maintains a private bug bounty program with a limited scope, which is not open
    to public enrollment.
  response_target: within two business days of submission
  safe_harbor: true
  safe_harbor_note: >-
    Submissions made consistent with the published guidelines are considered
    authorized conduct; CBRE states it will not initiate legal action against a
    researcher who follows them, and will inform third parties that the research
    was compliant if a third party pursues legal action.
policy:
- https://www.cbre.com/about-us/corporate-responsibility/vulnerability-disclosure
- https://hackerone.com/cbre
contact:
- kind: hackerone
  value: https://hackerone.com/cbre
  note: >-
    Reports are filed via the "Contact Security" button at the top of the HackerOne
    program page. No security@ email address is published.
reporting_requirements:
- Steps to reproduce the issue, with screenshots where helpful
- The affected target(s)
- The tools used during testing
in_scope_vulnerability_classes:
- Remote Code Execution
- SQL Injection
- Privilege Escalation to Admin Level
- XML Injection
- Insecure Direct Object Reference
out_of_scope:
- Physical testing, including IoT and IIoT devices, BMS and HVAC environments
- Social engineering
- Phishing
- Denial of service
- Resource exhaustion attacks
constraints:
- >-
  Researchers must not compromise data. If non-public information is encountered,
  testing must cease immediately and CBRE must be contacted.
evidence:
- source: https://www.cbre.com/about-us/corporate-responsibility/vulnerability-disclosure
  kind: disclosure-policy-page
  status: 200
  fetched: '2026-07-26'
  note: >-
    Retrieved via a text-extraction reader; a direct anonymous curl to cbre.com
    returns the Cloudflare interactive challenge (403).
- source: https://hackerone.com/cbre
  kind: bug-bounty-platform-program
  status: 200
  fetched: '2026-07-26'
negative_evidence:
- source: https://www.cbre.com.au/.well-known/security.txt
  status: 404
  fetched: '2026-07-26'
- source: https://www.cbre.com/.well-known/security.txt
  status: 404
  fetched: '2026-07-26'