Coinbase · Report #131192
User's legal name could be changed despite front end controls being disabled
Validstatus
2upvotes
5 May 2016disclosed
Summary
Despite the front-end form fields being disabled, a user could still change his/her legal name by manually manipulating the form in developer tools, or by manually creating a POST request with the necessary parameter names and values.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.