Lark Technologies · Report #1948506
Improper Access Control allows OTP bypass
Validstatus
mediumseverity
40upvotes
25 Oct 2023disclosed
Summary
By directly navigating to the Admin Log download endpoint, the OTP requirement being sent to the user's email could be bypassed and users within the organization could access Admin Logs without verifying their identity. We thank @kongwenbin for reporting this to our team and confirming its resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.