inviting collaborator using email disclose the hackerone account related to the user

How it was found

Summary

The new hackerone collaborator features allows users to disclose hackerone account related to a user without any interaction from the invitee

Description

In the old hackerone collaborator feature, if you invite a collaborator using an email, the related account to that email wont be disclosed up until the user accepts the invite. However, in the new collaborator feature, if you invite a collaborator using email, it would automatically resolves to the hackerone account related to the email address.

Steps to reproduce

1. In a report that allows collaborator invite, click manage collaborators.
2. add your dummy account as a collaborator using email address then click save

████

3. After saving, check the participants and notice that instead of a pending invite to an email address, it was already resolved to the hackerone account related to the email

{F2458957}

Impact

disclosing hackerone account related to an email. This can be used to enumerate hackerone users using email address