HackerOne · Report #929361
Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS.
Validstatus
lowseverity
71upvotes
2 Oct 2020disclosed
Summary
@spongebhav identified a vulnerability that let a victim believe their program membership wasn't shown on their profile, when in reality, it was. This could be used to identify system users of a program when the program blocked this.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.