Read-only team members can read all properties of webhooks
Low
Vulnerability Details
**Description:**
A team member can view all properties of webhooks despite not needing them.
### Steps To Reproduce
1. Have an admin of a program setup webhooks
2. As a team member (read-only)log in
3. Run the following graphql query:
```
{
query {
team(handle: "security") {
name
webhooks {
nodes {
id
secret
url
}
}
}
}
}
```
4. See that you get data back
## Impact
Read only users will be able to identify where webhooks exist and secrets
Actions
View on HackerOneReport Stats
- Report ID: 818848
- State: Closed
- Substate: resolved
- Upvotes: 29