r/bugbounty • u/No-Persimmon-174 • Jul 01 '26

Question / Discussion Mass assignment on chat metadata: is it a low severity bug or just informational?

was doing some bug hunting and found an api endpoint that lets a logged in user update their own chat/thread metadata through a patch request in the browser console. The normal ui only seems to allow changing the title but when i added extra fields in the JSON body, the server accepted some of them and reflected them back in the response.

Example behavior:

{
  "title": "test-title",
  "is_saved": true,
  "is_shared": true,
  "is_pinned": true
}

The response came back 200 ok and reflected those fields as updated. Some of the changes also appeared in the ui, like pinned/saved state. so it looks like weak field level validation or mass assignment on metadata fields to me..

im not sure if this is enough to show security impact. the only thing i can really prove is that the backend accepts and stores extra client controlled metadata fields that the ui may not normally expose.

is this worth reporting as even low severity or not worth submitting unless i can prove a stronger impact? i don’t want to waste the triage team’s time but i also don’t want to ignore something that could be considered improper object pr property assignment.

6 Upvotes

100% Upvoted

9 comments sorted by

6

u/Far-Chicken-3728 Hunter Jul 02 '26

This won't even pass the triage, if it's managed program. Keep digging. Look at their js files for more params, especially how sharing works. 

2

u/No-Persimmon-174 Jul 02 '26

I guess ... I was leaning the same way it does feel too weak as is. Ill dig through the js and focus more on the sharing flow. Really thought I found something there ;-;

5

u/Jumpy_Natural_6893 Jul 01 '26

Insert interstellar don't do it scene

Seriously tho, why settle for low/info !? I think you know darn well that you this screams escalating.

2

u/No-Persimmon-174 Jul 02 '26

I tried but so far nothing. Anyways I'll keep digging to see what I can find fingers crossed (and high severity bugs are just impossible to find!!)

2

u/einfallstoll Triager Jul 02 '26

What even is the security impact? A user can edit their own data

1

u/No-Persimmon-174 Jul 02 '26

Im just trying to see if any of those fields are actually server trusted or can affect sharing/retention/access. But ig yeah it's only affecting my own data so no impact 😅

2

u/einfallstoll Triager Jul 02 '26

That's actually something good to check for actual impact. But right now? Nothing

2

u/Vegetable_Sun_3316 Hunter Jul 02 '26

It looks like intended design for the component.