HackerOne Disclosed Reports - 2025-02-21

Medium
resolved

User Email Disclosure via ID-Based Invitation

Bug reported by Mohamed Kamal was disclosed at February 22, 2025, 2:13 am   |   Information Disclosure

The issue occurs when inviting a user by their WakaTime ID. If a user has set their email to private, their email address was disclosed when they were invited using their ID. This contradicted the privacy settings and led to unintended email exposure.

High
resolved

Insecure Direct Object Reference (IDOR) in GraphQL deleteProfileImages Mutation

Bug reported by AlphaHacks was disclosed at February 21, 2025, 10:18 pm   |   Insecure Direct Object Reference (IDOR)

The Insecure Direct Object Reference (IDOR) vulnerability was discovered in the GraphQL deleteProfileImages mutation of the Autodesk User Profile. The vulnerability could have allowed an attacker to delete another user's photo through the "id" parameter. Autodesk has addressed the vulnerability.

Low
resolved

Possible to enumerate valid files in password protected shares/files drop shares as well as spam folder with files

Bug reported by Lukas Reschke was disclosed at February 21, 2025, 10:39 am   |   Information Disclosure

The summary is as follows:

It was possible to enumerate valid files in password protected shares and file drop shares. Additionally, it was possible to spam the folder with empty files using an attacker-controlled file name. The vulnerability existed in the `DocumentAPIController#create` method, which did not validate whether the share was writable, upload-only, or password protected.