8x8 · Report #1499114
connect.8x8.com: Users with no permission can track/access restricted details/data via GET /api/v2/support/requests/<ticket number >HTTP/2
Validstatus
highseverity
31upvotes
15 Feb 2023disclosed
Summary
@emperor reported to us an issue where information about our internal support agents were visible via /api/v2/support/requests/<ticket number>.
Our team put additional Access Control checks in place, which resolved the issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.