Summary by Settle Vulnerability Disclosure Program
Fixed in October 2026. Label create, update and delete now check the caller's permissions server-side.
GraphQL label settings operations allow Viewer role changes
Disclosed by Albinj- Engagement Settle Vulnerability Disclosure Program
- Disclosed date 15 days ago
- Priority P4 Bugcrowd's VRT priority rating
- Status Resolved This vulnerability has been accepted and fixed
Summary by Albinj
Viewer-role users could create, rename and delete organization labels via GraphQL without server-side role checks.