Mozilla · Report #2382484
IDOR on Delete Email address features
Validstatus
highseverity
84upvotes
7 Mar 2024disclosed
Summary
An Insecure direct object reference vulnerability was found in Mozilla Monitor which allowed any user to delete secondary email addresses in other users' accounts, using the email address ID. The vulnerability was fixed by ensuring that the delete operation is properly scoped to a particular user.
Hello
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.