SingleStore · Report #3353035

Delete any folder for any user within the organization

Validstatus

lowseverity

35upvotes

1 Jul 2026disclosed

Summary

An IDOR vulnerability in the SingleStore backend API allowed low-privileged users to delete folders belonging to other users within the same organization by manipulating the folder_id parameter in DELETE requests to /public/notebooks/api/contents/<id>/_internal-s2-stage/folder_id/folder_name/ on backend.singlestore.com, bypassing authorization checks that should have verified folder ownership. The vulnerability (CWE-639) was rated CVSS 3.0 Low (3.8) due to high attack complexity requiring knowledge of two UUIDs, reported September 22, 2025, triaged October 2, 2025, and successfully patched by SingleStore on April 21, 2026.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original