🎯 New Report #3729501: Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass no rate limit)
🔺Severity: Critical
👽 Reporter: matty69v
⭐️ Reputation: 1039
🛠 State: resolved
💼 Team: Essity
💵 Bounty: null
🕐 Submitted: 2026-05-12
⏰ Disclosed: 2026-08-27 07:35:43
📝 Summary: A pre-authentication stored cross-site scripting (XSS) vulnerability was discovered in the customer service API of the Essity company. The API accepted unauthenticated ticket submissions with arbitrary HTML/JavaScript in multiple fields, bypassing reCAPTCHA validation, CSRF protection, and rate limiting. When customer service operators viewed these tickets in the Umbraco back-office, the stored XSS executed in their authenticated session, enabling potential account takeover and other attacks. Multiple stacked vulnerabilities, including lack of input sanitization and authorization checks, were identified.
📂 Report JSON File: 3729501
@hackeronereports