Mixmax · Report #235059
Privilege escalation-User who does not have access is able to add notes to the contact
Validstatus
highseverity
13upvotes
16 Jun 2017disclosed
Summary
We didn't properly check that users had read-write access to contacts when posting notes.
.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.