Read the researcher's report on HackerOne
A staff account without app-management permissions could invoke an Admin GraphQL mutation to generate session tokens for certain installed apps. The tokens enabled limited access to apps within the same shop; the program reports that it added an Apps-permission check.
How it was found
- The researcher tested the Admin GraphQL session-generation mutation using a staff account without permissions.
- The mutation returned a session token for an installed app.
- The program confirmed access was limited to a subset of apps in the current shop.
- Access needed
- A user account · an account
- User interaction
- None
- Whose object
- The attacker's own
- Boundary crossed
- A staff member without app permissions generated an app session token within their current shop.
- Root cause
- The mutation lacked an authorization check for the Apps permission.
- Impact
- A staff member without that permission could generate tokens and access a limited subset of installed apps in the same shop.
- Fix
- The program added an Apps-permission check to the mutation.
- Components
- Admin GraphQL mutation, app session-token generation, installed apps
- Confidence
- high
Missing authorisation checkPrivilege escalation
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-14. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Staff without Manage Themes permissions can update themes | A user account | No object involved | A staff member with Manage public listings permission could upload a theme without Manage themes permission. |
| June 2022 Incident Report | A privileged role | Another user's | An employee used internal access to customer reports, then disclosed their contents outside the platform for bounty gain. |
| An attacker can archive and unarchive any structured scope object on HackerOne | A user account | Another user's | An authenticated user's mutation changed a structured scope owned by another program. |
| Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}` | No account | Another user's | Unauthenticated access crossed the private-program visibility boundary to retrieve asset-group data. |
| Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin | A user account | The attacker's own | A webpage caused the extension to make authenticated requests to other origins using the victim’s session. |
| Informations disclosure - Access to some checkout informations | No account | Another user's | A guest requester accessed another user's checkout by supplying its sequential ID. |
| `socket` command allows sending data over WebSockets to arbitrary origins from Grammarly Extension | No account | No object involved | A web page caused the extension background context to connect to an attacker-selected WebSocket origin. |
| [URGENT] Opportunity to publish tweets on any twitters account | A user account | Another user's | A requester published a post through another user's account by altering the account identifier. |
| SMAP bypass | A user account | No object involved | A user-triggered copy fault leaves the kernel running with its user-page access restriction disabled. |
| Use Github pack with Coda employee github account (search code of Coda's private repositories) | No account | Another user's | Unauthenticated requests used another user's GitHub connection to search private repositories. |
| How the Arch Angel stole Live Events | Not clear from the report | No object involved | Alleged internal access was used to alter triage records and disrupt a service; not substantiated. |
| Unrestricted Access to Celery Flower Instance | No account | No object involved | An unauthenticated external user reached the Celery worker-management interface. |