HackerOne Disclosed Reports - 2026-11-10

Low
resolved

Unauthenticated attacker can book appointments at arbitrary times, including outside availability and in the past

Bug reported by mazen was disclosed at November 11, 2026, 12:50 am   |   Business Logic Errors

A vulnerability was discovered in the Calendar application's public appointment booking endpoint. The endpoint validated that a bookable slot existed within a requested time range, but then persisted the attacker-supplied start and end times instead of the validated slot values. This allowed unauthenticated attackers with access to the public booking link to create confirmed events on an organizer's calendar at arbitrary times, including outside configured availability windows, on unavailable days, in the past, and bypassing daily booking limits and conflict checks. The flaw was fixed by requiring the requested time to match an available slot exactly.

Critical
resolved

Blind SQL Injection — IBM Training Course Search API

Bug reported by Shadowbyte was disclosed at November 10, 2026, 3:05 pm   |   SQL Injection

A blind SQL injection vulnerability was identified in a training course search API. The vulnerability was reported by an external security researcher, analyzed, and subsequently remediated.

Critical
resolved

Mass PII Exposure: 120,000+ Consumer Email Addresses Leaked via Author Enumeration on ████████

Bug reported by Mattéo was disclosed at November 10, 2026, 7:41 am   |   Information Disclosure

A WordPress loyalty program was found to expose approximately 121,000 consumer email addresses through user enumeration. The email addresses were configured as display names and became publicly visible through author archive pages, REST API endpoints, and RSS feeds. The affected pages were not protected by noindex directives or robots.txt restrictions, making them indexable by search engines. Sequential user IDs could be enumerated without rate limiting, allowing for mass enumeration of the database. The exposure affected European Union consumers and potentially violated data protection regulations.