Read the researcher's report on HackerOne
The report describes a SAML-related indicator that could reveal whether some private programs existed. It withholds the discovery method and says the signal was not definitive, limiting confidence about the exact behavior and impact.
How it was found
- The researcher examined behavior associated with SAML-enabled programs.
- They observed an indicator correlated with the existence of some private programs.
- The report provides no test details or definitive confirmation method.
- The program made changes to help teams disguise their existence.
- Access needed
- Not clear from the report
- User interaction
- Not clear
- Whose object
- No object involved
- Boundary crossed
- A SAML-related signal could reveal the existence of private programs.
- Root cause
- SAML-related behavior exposed a signal that could indicate the existence of some private programs.
- Impact
- An observer could potentially infer that certain private programs existed, without definitive confirmation.
- Fix
- The program made changes intended to help teams disguise their existence.
- Components
- SAML authentication
- Confidence
- low
Information disclosureSAML flaw
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-15. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Confidential data of users and limited metadata of programs and reports accessible via GraphQL | Not clear from the report | Another user's | A GraphQL caller accessed other users' confidential data and restricted program or report metadata. |
| The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present | No account | Another user's | A public report representation exposed private attributes of its reporter. |
| Customer private program can disclose email any users through invited via username | A user account | Another user's | An invitation creator retrieved another user's email from a pending invitation record. |
| Access to multiple production Grafana dashboards | No account | No object involved | Unauthenticated access exposed production dashboards and their confidential metrics. |
| Open prod Jenkins instance | A user account | No object involved | A broadly available Google login granted access to Jenkins administrative capabilities. |
| An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name | A user account | The attacker's own | A report collaborator flow exposed an invitee's private email before invitation acceptance. |
| gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read | A user account | Another user's | An authenticated project user caused upload handling to read server-side files, including files outside their own uploads. |
| Employee's GitHub Token Found In Travis CI Build Logs | No account | Another user's | Publicly accessible build logs exposed a token that granted access to private repositories. |
| JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions | A user account | Another user's | A project commenter obtained Runner tokens from a project they could not access. |
| Partial disclosure of report activity through new "Export as .zip" feature | A user account | Another user's | A limited-disclosure report's visibility boundary was crossed to expose hidden comments through export. |
| Github information leaked | No account | No object involved | Internal-services development test data was exposed through a third-party repository. |
| AWS bucket leading to iOS test build code and configuration exposure | No account | No object involved | Public access exposed the program's test-build materials. |