HexBrain

HackerOne · Report #386997

Private program policy page still accessible after user left the program

Validstatus
mediumseverity
$2,500bounty
57upvotes
12 Aug 2018disclosed

How it was found

Hi Team,

Summary:

I have found a critical sensitive information disclosure, I'm not sure if this is a result of a new hackerone UI update, I observed that some of the UI has been change such as Hacktivity etc.

BUG: Now all private program policy page together with the updates is visible to me despite i already leave to those private program!

WHOLE POLICY PAGE WAS DISCLOSED:

Below screenshot is the sample, the private program name is ██████ which i already LEAVE long time ago, but now i can see their policy page!

██████

Impact

Private program disclcosure.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original