Program Email Nofication settings ignored when being added as an external contributor

Disclosed: 2019-08-07 23:01:26 By archangel To security
Low
Vulnerability Details
**Summary:** When being added as an external contributor to a report, the report title are displayed in the email notification despite the program email notification settings being set to `No Content` **Description:** Hey team! I noticed that programs have the ability to set their Email Notification settings, to `No Content`, which masks the report title: {F530569} This causes the hackers emails notifications to look like this: ███████ HOWEVER, if another hacker gets added as an external contributor to the report, the report title and activity are shown in the report: {F530572} ### Steps To Reproduce 1. As a Program admin, navigate to `Program Settings` 2. Click `Program` 3. Click `Email Notifications` 4. Click `No Content` 5. Go to any report in your program and invite any hacker to the report. 6. Check the hackers email, they will see the report title in the invitation email Hope that helps! ## Impact Information Disclosure bypassing a program setting
Actions
View on HackerOne
Report Stats
  • Report ID: 645264
  • State: Closed
  • Substate: resolved
  • Upvotes: 32
Share this report