ownCloud · Report #113211
No Any Kind of Protection on Delete account
Validstatus
1upvotes
2 Mar 2016disclosed
Summary
@gamho69 reported an issue within the owncloud.com website that allowed an attacker to send a delete request for owncloud.com account for other users if the mail address was known. This issue did not affect ownCloud server and only the marketing related activity on owncloud.com. Furthermore the deletion is a manual process on our side so that suspicious usage would be noticed.
To prevent the leak of private information such as names and mail address of the reporter this issue is only disclosed limitedly.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.