HexBrain
Open on HackerOneSign in

HackerOne · Report #109483

User with Read-Only permissions can request/approve public disclosure

Validstatus
$500bounty
3upvotes
19 Feb 2016disclosed

Summary

Team members that only had read-only permissions were able to both request and approve public disclosure. This would also allow read-only team members to post a public comment.

This bug depends on a trusted team member with read-only permissions. Because of that, the consequences are not severe.

How it was found

Hi,

I found out that a user who belongs to a group with Read-Only permission can still request and approuve public disclosure when the report is closed by privileged admin although that these permissions are only allowed if the user group has Report scope.

Consequently, the team member with limited scope can also post public comment through public dislosure request and that contradicts what was expected.

Proof Of Concept :

  1. Create a new user group with Read-Only permission
  2. Add a user to the group.
  3. Log in with that user account and browse a Closed report, you should now be able to request public disclosure.

Kind regards. Yassine ABOUKIR

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original