HexBrain

Enjin · Report #3589247

Unauthenticated File Upload to CDN

Validstatus
mediumseverity
56upvotes
18 May 2026disclosed

Summary

@ph0r3nsic demonstrated that it was possible to upload files to NFT.io with an unauthenticated session.

Whilst the endpoint used in the report only stored the files ephemerally (and therefore they would be purged after a few hours having not being captured), the Enjin team concluded there were no legitimate reason for an unauthenticated session to be able to interact with that endpoint in the first place and therefore pushed a fix to prevent it going forward.

The fix was deferred from release until the Monday as the issue was reported on Friday and didn't warrant an immediate resolution due to the low-impact nature of the vulnerability.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original