Uber · Report #127158
Possibility to get private email using UUID
Validstatus
82upvotes
15 Jun 2016disclosed
Summary
Given the UUID of a user it was possible to get their email address by passing in their UUID via POST to /support/tickets inside of the token parameter.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.