HackerOne · Report #75556

Accessing title of the report of which you are marked as duplicate

Validstatus

$500bounty

7upvotes

17 Jul 2015disclosed

Summary

Title of the Bug Report of which you were marked as Duplicate, was being leaked at Reputation log's page.

Hello,

You can see the title of the report of which you are marked as Duplicate

Steps to Reproduce:

Report a bug to a team
Now that team marks your bug as 'Duplicate (#Report_ID).(but does not shares the report with you)
When that bug is marked as Resolved then you can see the title of that bug at https://hackerone.com/settings/reputation/log

This is clearly a lack of authentication as unless the bug is not shared or it is not public you should not be allowed to see any of its content.

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original