Authorization flaw allows Bugcrowd staff to create customer only comments via API

Disclosed by
drunkrhin0
  • Engagement Bugcrowd
  • Disclosed date 16 days ago
  • Reward $300
  • Priority P4 Bugcrowd's VRT priority rating
  • Status Unresolved This vulnerability has been accepted and needs to be fixed
Summary by drunkrhin0

Authorization flaw in Bugcrowd staff API keys to create customer only comments via the API allowing them to manipulate the integrity of the data.

Activity