Uber · Report #1116387
IDOR leads to leak analytics of any restaurant
Validstatus
mediumseverity
123upvotes
29 Apr 2021disclosed
Summary
The GraphQL service at https://restaurant.uber.com, did not properly perform an authZ check, allowing an attacker to obtain detailed sales statistics, etc for any restaurant.
Writeup at https://0xprial.com/idor-leads-to-leak-any-uber-eats-restaurant-analytics/
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.