Uber · Report #580268
API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers.
Validstatus
highseverity
$750bounty
35upvotes
8 Jul 2021disclosed
Summary
There was an API endpoint on the Uber site campus-vtc.com that allows an attacker to view the full names, personal email addresses and phone numbers of 83 Uber France members. These were people who uploaded entries to a contest on campus-vtc.com.
Endpoint leaked some PII for the 83 Uber France users who entered a contest on this site.
Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/heald_ben for some Bug Bounty tool releases and blogs!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.