Lark Technologies · Report #785577
Improper generating of access link at go.larksuite.com leads to access to other organizations/users' private data
Validstatus
mediumseverity
33upvotes
27 Feb 2021disclosed
Summary
Improper generating of a Lark access link could have led an attacker to potentially brute force access codes revealing other organizations/users' private data. We have resolved this issue and thank @w2w for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.