🎯 New Report #3862641: IDOR allows user to access report details via reference.json endpoint
🔺Severity: Critical
👽 Reporter: sm41ldrag0n79 mbbank
⭐️ Reputation: 159
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 15000
🕐 Submitted: 2026-07-14
⏰ Disclosed: 2026-10-01 01:27:40
📝 Summary: An information disclosure vulnerability was identified in a report details endpoint that allowed unauthorized users to access private report information. Despite the endpoint returning an access-denied error response, sensitive report details were inadvertently exposed in the error message body. The vulnerability was discovered through testing with standard user accounts and has since been fixed. No evidence of exploitation was found.
📂 Report JSON File: 3862641
@hackeronereports