Moneybird · Report #1137218
Access control issue on invoice documents downloading feature.
Validstatus
lowseverity
29upvotes
1 Apr 2021disclosed
Summary
Reporter has found a way to download exports as an unauthorized user. This was only possible after changing the permissions for the user and having a certain page open during this change. The issue has been resolved by adding extra permission checks during the download action.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.