🎯 New Report #4071064: Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data
🔺Severity: Medium
👽 Reporter: ousski
⭐️ Reputation: 247
🛠 State: resolved
💼 Team: Essity
💵 Bounty: null
🕐 Submitted: 2026-09-29
⏰ Disclosed: 2026-10-14 12:32:47
📝 Summary: An unauthenticated self-registration endpoint was discovered on an internal supplier procurement portal. The registration form was fully functional and accessible without any invitation, approval code, or affiliation verification. A test account was successfully created and confirmed via email. Upon login, the account was granted access to live vendor data including vendor numbers and names through automatic API calls. The account was not sandboxed and returned real procurement system records rather than empty or restricted data.
📂 Report JSON File: 4071064
@hackeronereports