Unauthorized Reservation Cancellation Through IDOR Vulnerability

Summary

It is possible to cancel a reservation by knowing the reservation id, this is because the reservation feature does not require users to login. We were already aware of this issue.

It is possible to cancel a reservation just by knowing the reservation id

This was closed as a duplicate of an issue from 2019. Furthermore, knowing the reservation ID is not difficult since it is present in the URLs that people share on social media when they share their reservations. We fundamentally disagree on the conclusion of this report but nonetheless, I appreciate Yelp disclosing the issue