HackerOne Disclosed Reports - 2026-11-13

High
resolved

Cross-account stored XSS on app.basecamp.com leads to persistent administrator takeover

Bug reported by Mattéo was disclosed at November 13, 2026, 1:07 pm   |   Cross-site Scripting (XSS) - Stored

A cross-account stored cross-site scripting vulnerability was discovered in a project collaboration application. An outside collaborator could store a message containing malicious HTML within an attachment content attribute that appeared as a normal embed when viewed. When an account administrator opened the message's edit form, the stored HTML was normalized by the editor, exposing data attributes that survived sanitization. A legacy behavior was triggered that fetched attacker-controlled HTML and wrote it using innerHTML. The injected content included a cross-origin frame that was loaded by the application's frame handler, which propagated the victim's content security policy nonce to embedded scripts. This resulted in arbitrary JavaScript execution in the authenticated administrator's session. The executed script read the administrator's CSRF token and made authenticated requests to grant administrator privileges to the attacker's account. The attacker gained persistent administrative access to the victim account without compromising passwords or identity credentials.

Medium
resolved

Burp Community OpenAPI site-map action reads a local schema example through $id rebasing

Bug reported by 1rhino2 was disclosed at November 13, 2026, 10:31 am   |   Path Traversal

A local resource restriction bypass was discovered in Burp Community's OpenAPI site-map action. The vulnerability resulted from a validator and click parser selecting different OpenAPI objects from the same HTTP response. A nested OpenAPI 3.0 object made the action available, while the click handler parsed a top-level OpenAPI 3.1 object. In the 3.1 schema, a local file URL in an identifier field was used as the base for a fragment-only reference, bypassing external API definition checks. The local JSON schema was opened and its selected example value was copied into the generated request body. The issue was reproduced on two stable builds through the standard user interface in fresh temporary projects. Community did not send the generated request automatically, and disclosure to the server required a later explicit send by the user.