地图 / Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure

Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure

不安全的直接对象引用 / IDOR / #3467641

厂商: Basecamp
严重程度: 低危
赏金: $100
弱点: IDOR
研究员: @perxibes
披露日期: 2026-03-16
资产: app.fizzy.do
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1522 字符中的一小部分）

Unauthenticated access to private files and previews via Active Storage URLs (IDOR)

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Basecamp 所有。

时间线

2025-12-16报告提交
2026-03-16公开披露

阅读 HackerOne 原文 ↗作者 @perxibes · 版权归作者与 Basecamp 所有

同类报告

Delete anyone's content spotlight remotely.Snapchat · 2023-03-06 · $15,000 IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersPayPal · 2019-07-30 · $10,500 How the Bug stole hackingHackerOne · 2019-12-20 IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryHackerOne · 2023-08-29 IDOR allow access to payments data of any userNord Security · —IDOR allows user to access report details via reference.json endpointHackerOne · 2026-10-01 · $15,000