HackerOne Disclosed Reports - 2025-08-12

Low
resolved

Exceed the maximum number of subscribers using Race Condition

Bug reported by Ali Abbas was disclosed at August 12, 2025, 7:52 pm   |   Business Logic Errors

A race condition vulnerability was discovered in the SingleStore control panel that allowed bypassing the maximum limit of five subscribers for alerts. The issue was patched and deployed to production.

Medium
resolved

IDOR - Scheduled data leak to other accounts By "projectID"

Bug reported by Ali Abbas was disclosed at August 12, 2025, 7:47 pm   |   Business Logic Errors

The Insecure Direct Object Reference (IDOR) vulnerability was discovered in the GetNotebookScheduledPaginatedJobs endpoint on backend.singlestore.com. The API failed to verify the requestor's permission to access the specified project, allowing an authenticated user to access scheduled job information belonging to other users' projects by modifying the projectID parameter. The vulnerability exposed sensitive information such as database names, notebook paths, scheduling details, and infrastructure information.