[Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content"

How it was found

Hi Team,

Summary:

There is newly disclosed resolved report Program Email Nofication settings ignored when being added as an external contributor, However i found that the fix is incomplete.

I have found that email invitation for a collaborator (bounty splitting) still disclosing the Report title in email when the notification comes from Manage Collaborator invitation.

Steps To Reproduce

Assumes that Manage Collaborator (bounty splitting) is enabled to the program

1. As a program admin, navigate to Program Settings > Click Program >Click Email Notifications
2. In email notification settings, select No Content
3. Go to any report in your program and invite any hacker to the report to become a Collaborator.
4. Hacker can also invite Collaborator.
5. Check the invited hackers email, they will see the report title in the collaboration invitation email.

PoC screenshot below:

{F549793}

{F549792}

Impact

Sensitive information disclosing bypassing the program settings.

Regards Japz