Lark Technologies · Report #890209
Sub-Dept User Can Add User's To Main Department.
Validstatus
mediumseverity
10upvotes
18 Oct 2022disclosed
Summary
A vulnerability was found where users with permissions to manage the user section can add others outside of their department by changing the value of "department_id" to an empty value. We thank @imran_nisar for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.