Instacart · Report #344284
View & add to cart unlisted items via IDOR
Validstatus
highseverity
19upvotes
25 May 2018disclosed
Summary
Access Control vulnerability that would let an attacker order certain items from the API, even though they are missing from the Web catalog
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.