HexBrain

HackerOne · Report #816143

A team member of the program with Report rights can ban the Admin

Validstatus
lowseverity
30upvotes
15 May 2020disclosed

How it was found

Summary:

Our team has conducted a number of studies (tests) in the field of permission Report. We noticed that a team member of the program with such permission can ban a member with Admin rights

Steps To Reproduce:

  1. Admin submit new report in program
  2. A team member with Report rights can use the 'Ban reporters ' panel via their report

my group - one_permission have permission Report

{F743466} █████

  1. After ban , admin can't create new report in program (it's not logical)

{F743464}

Impact

Ban the Admin in program

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original