HackerOne · Report #2096271
Staff and Triage can modify the initial post of a report, including of already disclosed reports
Validstatus
mediumseverity
50upvotes
28 Aug 2023disclosed
Summary
Update: We've been notified of reports that describe a similar vulnerability, this is a duplicate of #2061367 - the hacker has been awarded with the bounty they deserved.
How it was found
FULL DISCLOSURE: I am a HackerOne employee and learned about it through this submission: https://███████-/issues/67828
Summary:
Members of the HackerOne program (and likely other program members on their own program) and Triage can edit the information of the original report
I used https://hackerone.com/reports/2000000 to demonstrate and the changes have since been reverted.
Description:
Steps To Reproduce
- Go to any report, disclosed or undisclosed
- Press "edit information" on the original post
- Edit & save.
- Your changes are saved
Optional: Supporting Material/References (Screenshots)
{F2560190} {F2560189} {F2560191} {F2560195}
Impact
Members and Triage can rewrite the story the hacker is trying to tell and edits are not transparant
- Give hackers a bad image in disclosed reports
- Tell a different story or lower impact artificially
- The body is supposed to be immutable after 20 minutes