Lark Technologies · Report #1363185
Attacker is able to join any tenant on larksuite and view personal files/chats.
Validstatus
criticalseverity
84upvotes
3 Nov 2021disclosed
Summary
A privilege escalation issue was found in Open.larksuite.com, which could have potentially allowed attackers to join any tenant, and view files and communications that are shared by team members. We thank @imran_nisar for reporting this to our team and confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.