HexBrain

HackerOne · Report #2278865

Some limited confidential information can still be accessed after a user exits a private program

Validstatus
mediumseverity
$50bounty
86upvotes
19 Jan 2024disclosed

How it was found

Good morning team!!! I identified a bug where it is possible to access some limited confidential information from a private program even after you have already exited that program. information like: :number of domains :Bounties paid :Number of hackers paid :Response efficiency :Minimum reward and maximum reward :Sobre

steps: 1:do you accept a private invitation 2:you add this program to your favorites 3:the expiry date for sending reports arrives 4:Now you can no longer send reports to this program or have access to its policy page 5:now go to opportunities -> My programs 6:And there is your program and you have access to the information mentioned above

Impact

Disclosure of private program information

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original