🎯 New Report #3353035: Delete any folder for any user within the organization
🔺Severity: Low
👽 Reporter: bl4ck-
⭐️ Reputation: 907
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2025-09-22
⏰ Disclosed: 2026-07-01 17:39:22
📝 Summary: A vulnerability in the SingleStore backend API allowed low-privileged users to delete folders belonging to other users within the same organization by manipulating the folder id parameter in DELETE requests. The vulnerability was rated CVSS 3.0 Low (3.8) due to high attack complexity requiring knowledge of two UUIDs, reported on September 22, 2025, triaged on October 2, 2025, and successfully patched by SingleStore on April 21, 2026.
📂 Report JSON File: 3353035
@hackeronereports