Read-only team members can read all properties of webhooks

Disclosed: 2020-04-29 17:21:29 By bencode To security
Low
Vulnerability Details
**Description:** A team member can view all properties of webhooks despite not needing them. ### Steps To Reproduce 1. Have an admin of a program setup webhooks 2. As a team member (read-only)log in 3. Run the following graphql query: ``` { query { team(handle: "security") { name webhooks { nodes { id secret url } } } } } ``` 4. See that you get data back ## Impact Read only users will be able to identify where webhooks exist and secrets
Actions
View on HackerOne
Report Stats
  • Report ID: 818848
  • State: Closed
  • Substate: resolved
  • Upvotes: 29
Share this report