🎯 New Report #3543475: Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure
🔺Severity: Low
👽 Reporter: xavlimsg
⭐️ Reputation: 551
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 218
🕐 Submitted: 2026-02-07
⏰ Disclosed: 2026-04-14 19:25:39
📝 Summary: The vulnerability allowed for cross-tenant ActionText reference resolution and data disclosure during the account import flow. The import process did not properly verify the ownership of the referenced records before minting signed global IDs, enabling an attacker to access and disclose data from other accounts.
📂 Report JSON File: 3543475
@hackeronereports