Low · CVSS 3.2Improper Access Control - Generic (CWE-284)
Can download files on Android app without permission
Vulnerability Summary
HackerOne disclosed report --> https://hackerone.com/reports/2380133 by hakuna
Summary:
If the owner of a file - of type PDF, document, image or presentation - shares it with a user and disable download, the user can still download it using the Android app.
Related Writeups
hackerone-reportsEasy way to create a new Deck board without permission
HackerOne disclosed report --> https://hackerone.com/reports/2388183 by hakuna
Read Writeup →
hackerone-reports2FA requirement bypass when inviting team members
HackerOne disclosed report --> https://hackerone.com/reports/3356149 by 0x7ashish
Read Writeup →