Read the researcher's report on HackerOne
The report describes a holiday-themed challenge sequence, including exposed clues, client-side flag construction, and enumeration of person records through predictable encoded IDs. The final swag-shop discovery process is cut off, so its outcome and any broader impact are unclear.
How it was found
- Checked the crawler-exclusion file and found a hidden path and flag.
- Inspected the page and its JavaScript to locate a flag assembled from fragments and a subsequent path.
- Decoded a record identifier, changed its underlying numeric value, and retrieved the record with the preceding ID.
- Enumerated web paths for the shop, but the report ends before showing results.
- Access needed
- No account
- User interaction
- None
- Whose object
- Another user's
- Boundary crossed
- A visitor changed a record ID to access an entry not presented in the list.
- Root cause
- Sensitive challenge data and record access were exposed through discoverable paths, client-side code, and identifiers that were only Base64-encoded.
- Impact
- An unauthenticated visitor could discover challenge secrets and access a record outside the displayed list, but the report does not establish real user data exposure.
- Components
- crawler-exclusion file, client-side JavaScript, people-rating API, shop API
- Confidence
- medium
IDOR / object referenceInformation disclosure
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-14. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions | A user account | Another user's | A project commenter obtained Runner tokens from a project they could not access. |
| Information Disclosure in /skills call | A user account | Another user's | An applicant could read another applicant’s submitted report titles within the same skill set. |
| Internal attachments can be exported via "Export as .zip" feature | A user account | Another user's | A report export exposed attachments restricted to team members. |
| Snippet JS template allows attacker to read a user's private snippets | No account | Another user's | A third-party page read another user's private snippet through its JavaScript representation. |
| Access to all files of remote user through shared file | A user account | Another user's | A share recipient's WebDAV copy operation exposed the sharer's broader file storage. |
| Internal Gitlab Ticket Disclosure via External Slack Channels | A user account | Another user's | An external workspace participant accessed employee-only GitLab tickets through Slack previews. |
| Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is Known | A user account | Another user's | A feature user viewed another creator's private video by supplying its identifier. |
| Possible PII Disclosure via Advanced Vetting Process - ██████ | A user account | Another user's | An authenticated user without program access could read finders' vetting acceptance data. |
| [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" | A user account | Another user's | A program-side view exposed confidential metadata for a Spot Check record. |
| # Drivers can access the customers phone number, current location without getting their offer accepted! | A user account | Another user's | A driver retrieved another customer's contact and location data before their offer was accepted. |
| Any organization's assets pending review can be downloaded | A user account | Another user's | A user accessed another organization's pending-review asset export by changing its handle. |
| User Email Disclosure via ID-Based Invitation | A user account | Another user's | An organization member obtained another user's private email through an ID-based invitation. |