Lark Technologies · Report #1074420
IDOR Allows Viewer to Delete Bin's Files
Validstatus
mediumseverity
16upvotes
24 Oct 2022disclosed
Summary
An IDOR (Insecure Direct Object Reference) vulnerability was found where if a user with only view permissions knew the alphanumeric token of a folder, they could permanently delete it from an admin's bin. We thank @snapsec for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.