Messages disclosure via search feature of other users group(Cross-Tenant).

Summary

Due to a Insecure Direct Object Reference (IDOR) vulnerability identified within the message search function of Lark, an attacker could have potentially viewed messages, docs, and attachments shared in other users groups. We thank @base_64 for reporting this to our team and verifying the resolution.

An IDOR vulnerability was found in message search feature of groups, which allows attacker to query messages sent in other users groups. attacker could view all the messages, docs, pics shared in other users groups.