🎯 New Report #4020767: Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████
🔺Severity: Critical
👽 Reporter: agusnicco
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Essity
💵 Bounty: null
🕐 Submitted: 2026-09-11
⏰ Disclosed: 2026-09-18 06:04:10
📝 Summary: An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message history of any conversation, create new conversations, and delete any conversation. The deletion of a conversation was incomplete, as the underlying messages remained retrievable even after the conversation was removed from the listing.
📂 Report JSON File: 4020767
@hackeronereports