Valve · Report #835087
ajaxgetachievementsforgame is not guarded for unreleased apps
Validstatus
mediumseverity
$750bounty
14upvotes
30 Jul 2020disclosed
Summary
Due to an access control bug in the 'ajaxgetachievementsforgame' method, a public profile could accidentally expose achievement names, display names, and descriptions for unreleased games. The caller would need to find a player with achievements for the unreleased app.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.