LogicalBreach Academy

Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure | Free Bug Bounty Writeup | LogicalBreach Academy

Writeups Cheatsheets Tools Collections Authors Noc Pricing

Back

Improper Access Control - Generic (CWE-284)CVSS 3.1Hard

Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure

hackerone-reports

April 18, 2026

0 views

Save

€205

Vulnerability Summary

HackerOne disclosed report --> https://hackerone.com/reports/3543475 by xavlimsg

Description

The account import flow processes ActionText attachment HTML from user-uploaded ZIP content.

In app/models/account/data_transfer/action_text_rich_text_record_set.rb, import-time method convert_gids_to_sgids converts attacker-controlled gid values into persisted sgid values by resolving the target record globally:

app/models/account/data_transfer/action_text_rich_text_record_set.rb:83
app/models/account/data_transfer/action_text_rich_text_record_set.rb:87
app/models/account/data_transfer/action_text_rich_text_record_set.rb:88
app/models/account/data_transfer/action_text_rich_text_record_set.rb:89

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

hackerone-reports

€13,553 Documented

Profile →

Related Writeups

hackerone-reports

[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]

HackerOne disclosed report --> https://hackerone.com/reports/3020021 by adilnbabras

Read Writeup →

hackerone-reports

User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon

HackerOne disclosed report --> https://hackerone.com/reports/3325582 by adilnbabras

Read Writeup →

hackerone-reports

[Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale

HackerOne disclosed report --> https://hackerone.com/reports/3025797 by adilnbabras

Read Writeup →

Discussion

No comments yet.

Be the first to share your thoughts

Premium writeups about bug bounty hunting and web security.
Written by real security researchers.

Navigation

Writeups Cheatsheets Tools Authors Noc Pricing

Contactcontact@logicalbreach.com

RSS FeedPrivacy PolicyTerms of Service