Moneybird · Report #726163
IDOR in https://moneybird.com/user/accountant_company/edit(change company name)
Validstatus
lowseverity
22upvotes
21 Sept 2021disclosed
Summary
Reporter found a way to change the name of an accountant company for which he didn't have permissions. We added extra checks to prevent these kind of Insecure Direct Object Reference bugs.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.