HexBrain

Algolia · Report #118925

API Key added for one Indices works for all other indices too.

Validstatus
$1,000bounty
6upvotes
1 Jun 2016disclosed

How it was found

Hi,

I created one API key and restricted it to only one index by adding it and gave it right for creating record. Now this api can be used to add records in other indeces in same account.

Screenshot is attached

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original