HexBrain

Weblate · Report #223846

Access to completion page without performing any action

Validstatus
5upvotes
18 May 2017disclosed

How it was found

Hi!,

This is much of a best practice as it doesn't have much impact on the user. But I believe you may want to know.

After making a registration or on finalizing a password reset, one is redirected to a page, https://demo.weblate.org/accounts/email-sent/. I noticed that even without making any of the two actions stated above, the page is still accessible.

Regards, Shuaib

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original