Information Disclosure via “Add user” lookup in Account Management (User Access)
信息泄露 / Exposure of Sensitive Information Due to Incompatible Policies / #3401464
该报告还没有中文解读。
原文摘录
摘自原文（1615 字符中的一小部分）
Summary: When a user under Management 1 navigates to `User Access → Add user` and enters a username, the system performs a global lookup across all accounts instead of restricting the search to the current account’s scope. If the entered username belongs to a user from another account (e.g., …
原文中的代码
Administrator Account
├── Management 1
│ ├── User A1
│ └── User A2
└── Management 2
├── User B1 (leak email, contacname)
└── User B2 (leak email, contacname)默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Revive Adserver 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @yoyomiski · 版权归作者与 Revive Adserver 所有