Team member invitations to sandboxed teams are not invalidated consistently

Disclosed: 2015-03-28 22:38:44 By mazengamal To security
Unknown
Vulnerability Details
hello today i found a Bug about Auth in Send invitation to member to join the team ,, so if Now The Victim Send invition to Another Victim Account to join the team as a Manager,, the link of the invitation is will Be Valid For Many Many Many time to Accept the invtiation from Another Accounts in H1 so let's say example : A send invtation emai to B the other Acconts could access to the Account and open it and Accept the invtiation Without invtiet them !!! the invetion url :https://hackerone.com/invitations/54a725ee8c5b8d7c1225e8b486716145 the poc : http://youtu.be/dL7FOBCssFE
Actions
View on HackerOne
Report Stats
  • Report ID: 46429
  • State: Closed
  • Substate: resolved
  • Upvotes: 3
Share this report