🎯 New Report #3577216: `exportReportPdf` mutation shows internal Activity
🔺Severity: High
👽 Reporter: 0v3rw4tch
⭐️ Reputation: 1085
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: null
🕐 Submitted: 2026-02-27
⏰ Disclosed: 2026-07-29 15:01:10
📝 Summary: A vulnerability was identified in the PDF export path for disclosed reports. When a report was exported to PDF, the export pipeline did not apply the same visibility and authorization scoping that governs the normal report view. The root cause was that PDF generation assembled report content from the underlying timeline without re-checking each activity against the requester's permission level. The issue was promptly fixed by enforcing the same per-activity visibility checks and disclosure-level scoping along the export path.
📂 Report JSON File: 3577216
@hackeronereports