Low · CVSS 2.5Improper Access Control - Generic (CWE-284)
Easy way to create a new Deck board without permission
Vulnerability Summary
HackerOne disclosed report --> https://hackerone.com/reports/2388183 by hakuna
Summary:
Admins can decide which groups are allowed to create boards. But a user who is part of an unauthorized group can easily create a new board by cloning an existing one and renaming it.
Related Writeups
hackerone-reportsCan download files on Android app without permission
HackerOne disclosed report --> https://hackerone.com/reports/2380133 by hakuna
Read Writeup →
hackerone-reports2FA requirement bypass when inviting team members
HackerOne disclosed report --> https://hackerone.com/reports/3356149 by 0x7ashish
Read Writeup →