8x8 · Report #1473071
connect.8x8.com: deactivated users remain access to /api/v1/users/UUID/roles
Validstatus
highseverity
24upvotes
15 Feb 2023disclosed
Summary
@emperor & @sharp488 reported to us a scenario where deactivated users remain access to /api/v1/users/UUID/roles within their own tenant.
Our team utilised the insights from this report to work on additional access control protections, which resolved the reported issues.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.