Uber · Report #1063022
Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees
Validstatus
mediumseverity
29upvotes
14 May 2021disclosed
Summary
A Business employee with the user role was able to escalate their privilege to admin using a crafted request to the https://business.uber.com/_rpc?rpc=updateEmployees endpoint, as long as the employeeUuid is known.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.