Slack · Report #147544
Generate new Test token
Validstatus
$100bounty
5upvotes
15 Sept 2016disclosed
Summary
A hacker can get a token XOXP administrator without being the administrator of the community even without being a member of the same.
Bug Fixed.
How it was found
We can generate a token test in any community that we are to use the API in the community (although we are not community managers)
In the attached video, I show you how to generate a token in a community in which I am not administrator and I can check absolutely everything and even make use of the API.
Note: talk to the administrator of the community to make this test getbootstrap.