Lark Technologies · Report #1021460
Privilege Escalation to All-staff group
Validstatus
mediumseverity
26upvotes
28 Oct 2022disclosed
Summary
A vulnerability was found where invited admins with only Company Info permissions were able to modify Staff group settings, including edit / access / delete all-staff, within the members and orgs tab. We thank @snapsec for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.