🎯 New Report #3878586: Unauthenticated team "income/payments" export ignores donor privacy settings (hide giving, hide from lists) and uses frozen visibility, exposing donat
🔺Severity: Medium
👽 Reporter: its9me
⭐️ Reputation: 171
🛠 State: resolved
💼 Team: Liberapay
💵 Bounty: 100
🕐 Submitted: 2026-07-21
⏰ Disclosed: 2026-08-01 12:27:05
📝 Summary: A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as "hide giving" and "hide from lists". The root cause was that the endpoint only honored the frozen visibility flag of the payment, and ignored the donor's current privacy settings as well as the recipient's opt-in gate. This resulted in the exposure of donations that the donor had since made private or secret.
📂 Report JSON File: 3878586
@hackeronereports