Mars · Report #2354888
unsubscribe anyone from all ████████ emails @ █████
Validstatus
lowseverity
45upvotes
25 Nov 2024disclosed
Summary
A vulnerability is reported in the unsubscribe functionality of ████████. The issue allows for the unsubscription of arbitrary users from all Banfield emails by manipulating the subscriber ID (sid) parameter in the unsubscribe URL. This vulnerability is classified under CWE-284: Improper Access Control. The predictable nature of the sid parameter enables potential mass unsubscription of customers from email communications.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.