Uber · Report #178503
ability to retrieve a user's phone-number/email for a given inviteCode
Validstatus
6upvotes
17 May 2017disclosed
Summary
The www.uber.com/a/join?invite_code=inviteCode endpoint returned email and/or phone number for the user with the invite code inviteCode.
Since protecting our users data is our top priority, we were very interested in this report. It was also a pleasure to work with @kushal89shah and we look forward to more reports in the future!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.