HackerOne · Report #816143
A team member of the program with Report rights can ban the Admin
Validstatus
lowseverity
30upvotes
15 May 2020disclosed
How it was found
Summary:
Our team has conducted a number of studies (tests) in the field of permission Report. We noticed that a team member of the program with such permission can ban a member with Admin rights
Steps To Reproduce:
- Admin submit new report in program
- A team member with Report rights can use the 'Ban reporters ' panel via their report
my group - one_permission have permission Report
{F743466} █████
- After
ban, admin can't create new report in program (it's not logical)
{F743464}
Impact
Ban the Admin in program