HexBrain

Slack · Report #1248852

Misuse of groups feature allows workspace members to join private channels without being invited

Validstatus
highseverity
23upvotes
21 Oct 2021disclosed

Summary

@kmap alerted us to an issue that would have allowed workspace members to join private channels through misuse of our User Groups feature. The bug was fixed on the next day, and Slack notified the few customers with users matching the conditions in the report. Many thanks to @kmap for reporting this!

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original