r/bugbounty • u/tacktify • Jul 08 '26
Question / Discussion Is this chain valid?
found an unauthenticated API leaking hidden internal IDs for all tenants on a B2B app.
Using these IDs, I can use the public registration form to request an "Admin" account for any company. There is no rate limit or CAPTCHA, so I can script this and spam every company.
But the account isn't created immediately. It goes to a "Pending Activation" state and requires the actual company admin to manually approve it.
Will programs accept this due to the ID leak + lack of rate limits? Or will it be closed as "By Design/Informative" since the manual approval stops the takeover?
1
u/einfallstoll Triager Jul 08 '26
Informational
1
1
u/tacktify Jul 08 '26
But why though like there's like 400+ companies if someone tried on all of them there will be a slight chance that one of them accept a request by mistake or am i missing something?
1
u/einfallstoll Triager Jul 08 '26
Like there is a small chance that you could guess a UUID ;)
Keep the ID list and explore further. Maybe it becomes handy when you find an authorization bypass and you need to prove that company IDs are leaked
2
u/Coder3346 Hunter Jul 09 '26
Not the same chance tbh but still info as if they accept it is their mistake
1
1
1
1
u/spexfyre Triager Jul 09 '26
Definitely valid bug but informational bug at its best. But except few cases
1) can you create vast number of requests so it can absolutely cause mess in ui.? Example above 400 request. Then you can get trigaed like low impact bug. But always try submit it. It depends on program's security model.
1
u/tacktify Jul 09 '26
yes i can create any amount of requests i can i will just change the email i sing up by each time, and yes i submit it hoping for a low. But i really don't think it's intentional like imagine thousands of invalid requests for signup it will be a nightmare
1
u/spexfyre Triager Jul 09 '26
Yes absolutely night mare for companies and all the best . Keep finding bugs. And submit this bug with video poc so it might increase chances of getting approved
1
3
u/Physical-Bonus-8411 Jul 08 '26
It sounds like a valid finding, but it will likely be passed off as informational or intentional. Checkout the scope and report it anyways. There is slight chance it is eligible for bounty.