Valve · Report #350937
GetReports works for hubs you don't have access to
Validstatus
mediumseverity
$750bounty
24upvotes
30 May 2018disclosed
Summary
Admin permissions on a game hub could be leveraged to view UGC reports on unrelated games.
If an account had admin permissions on a game hub, he'd be able to view other game hubs UGC reports by simply making the appid parameter the appid of the game hub he has admin permissions on.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.