Starbucks · Report #715054
China - IDOR on Reservation Staging/Non Production Site - https://reservation.stg.starbucks.com.cn
Validstatus
mediumseverity
45upvotes
22 Sept 2020disclosed
Summary
xmfc discovered that the staging/non production site at https://reservation.stg.starbucks.com.cn/api/customer/reservation/history allowed anyone to retrieve fabricated test user reservation data by providing a OTP of 111111. @xmfc — thank you for reporting this vulnerability and for confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.