HackerOne Disclosed Reports - 2026-11-08

Medium
resolved

Broken Access Control on **healthwatch.trellix.com** Leading to Unauthorized Access and Sensitive Data Exposure

Bug reported by t4f3 was disclosed at November 8, 2026, 10:22 pm   |   Improper Access Control - Generic

A broken access control vulnerability was discovered on a health monitoring platform. The vulnerability consisted of three chained security flaws: insufficient email domain validation during account registration allowed attackers to register accounts with external email addresses, a password reset mechanism could be exploited to activate accounts pending administrator approval, and an improperly secured API endpoint lacked authorization controls, allowing enumerated retrieval of complete customer business information and internal employee contact details. The vulnerabilities combined enabled unauthorized application access and sensitive organizational data exposure.