Slack · Report #1248852
Misuse of groups feature allows workspace members to join private channels without being invited
Validstatus
highseverity
23upvotes
21 Oct 2021disclosed
Summary
@kmap alerted us to an issue that would have allowed workspace members to join private channels through misuse of our User Groups feature. The bug was fixed on the next day, and Slack notified the few customers with users matching the conditions in the report. Many thanks to @kmap for reporting this!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.