HexBrain

Uber · Report #151465

Get organization info base on uuid

Validstatus
$3,000bounty
26upvotes
2 Sept 2016disclosed

How it was found

Hi Uber, I found issue on https://business.uber.com/server/employees

Step to reproduce:

  1. Send post request to https://business.uber.com/server/employees:
  2. Change userUuid of other user and then see organization info if they has valid organization and their persinol info

Best ragards, Severus

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original