HackerOne · Report #2061367
Triager/Team members can edit hacker's report and hacker is not even notified
Validstatus
mediumseverity
$2,500bounty
84upvotes
31 Aug 2023disclosed
Summary
This report is identical to https://hackerone.com/reports/2096271, but was reporter earlier. As result, we have retroactively awarded the hacker.
How it was found
Summary:
Hi Team I have created a dummy program and I noticed that Triager/Team member can edit hacker's report. **If you say this is a feature for the team, there should be a mechanism to ask permission from hacker to edit the report **
Steps To Reproduce
- Create a dummy report
- Open the report as team member
- You will see a edit option near hacker's report
- Using that option edit the report
█████
Impact
A triager/team member may edit hacker's report which highly impact the integrity of the report as there is no way hacker can proof that whether his submitted report was edited or not as you can see I have changed the whole content of the report and it also not notifying that the report has been updated