Starbucks · Report #659248
China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API Endpoint
Validstatus
criticalseverity
116upvotes
1 Apr 2020disclosed
Summary
0xpatrik discovered an unauthenticated API endpoint that allowed retrieval of specified work leave dates of designated Starbucks employees in China. @0xpatrik — thank you for reporting the original vulnerability and for confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.