inviting collaborator using email disclose the hackerone account related to the user
Medium
Vulnerability Details
##Summary
The new hackerone collaborator features allows users to disclose hackerone account related to a user without any interaction from the invitee
##Description
In the old hackerone collaborator feature, if you invite a collaborator using an email, the related account to that email wont be disclosed up until the user accepts the invite. However, in the new collaborator feature, if you invite a collaborator using email, it would automatically resolves to the hackerone account related to the email address.
##Steps to reproduce
1. In a report that allows collaborator invite, click manage collaborators.
2. add your dummy account as a collaborator using email address then click save
{F2458958}
3. After saving, check the participants and notice that instead of a pending invite to an email address, it was already resolved to the hackerone account related to the email
{F2458957}
## Impact
disclosing hackerone account related to an email. This can be used to enumerate hackerone users using email address
Actions
View on HackerOneReport Stats
- Report ID: 2045722
- State: Closed
- Substate: resolved
- Upvotes: 67