HexBrain

Valve · Report #541020

GetGlobalAchievementPercentagesForApp is missing the same release checks as GetSchemaForGame

Validstatus
mediumseverity
22upvotes
19 Feb 2020disclosed

How it was found

GetGlobalAchievementPercentagesForApp API method can be used to reveal achievement names/percentages for games that have not been released yet.

This is not a problem with GetSchemaForGame method, which leads me to believe the other method is missing all the relevant checks.

https://api.steampowered.com/ISteamUserStats/GetGlobalAchievementPercentagesForApp/v2/?gameid=██████ https://api.steampowered.com/ISteamUserStats/GetSchemaForGame/v1/?appid=████

GetGlobalAchievementPercentagesForApp should have the same release state checks as GetSchemaForGame as to not leak achievement names.

Impact

This can be used to reveal and leak work-in-progress achievements for games that have not been released yet.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original