HexBrain

LinkedIn · Report #1945417

“See who’s interested in working for your company” - security issue

Validstatus
mediumseverity
28upvotes
21 Jun 2023disclosed

Summary

The issue identified by @headhunter required a member have access to LinkedIn Recruiter and was related to the "See who’s interested in working for your company" feature. The issue allowed the recruiter to view profiles of members interested in working for certain companies. After validating the vulnerability report, a fix was deployed to production within one month. Thanks again for your continued great work @headhunter!

A security issue existed that could potentially exploit LinkedIn's new feature, "See who’s interested in working for your company". With the use of LinkedIn's Recruiter product, an attacker could access the list of individuals showing interest in working at any company registered at LinkedIn (where this feature was activated on the LinkedIn page).

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original