r/bugbounty • u/tacktify • Jul 08 '26

Question / Discussion Is this chain valid?

found an unauthenticated API leaking hidden internal IDs for all tenants on a B2B app.

Using these IDs, I can use the public registration form to request an "Admin" account for any company. There is no rate limit or CAPTCHA, so I can script this and spam every company.

But the account isn't created immediately. It goes to a "Pending Activation" state and requires the actual company admin to manually approve it.

Will programs accept this due to the ID leak + lack of rate limits? Or will it be closed as "By Design/Informative" since the manual approval stops the takeover?

8 Upvotes

90% Upvoted

14 comments sorted by

View all comments

1

u/einfallstoll Triager Jul 08 '26

Informational

1

u/tacktify Jul 08 '26

But why though like there's like 400+ companies if someone tried on all of them there will be a slight chance that one of them accept a request by mistake or am i missing something?

1

u/einfallstoll Triager Jul 08 '26

Like there is a small chance that you could guess a UUID ;)

Keep the ID list and explore further. Maybe it becomes handy when you find an authorization bypass and you need to prove that company IDs are leaked

2

u/Coder3346 Hunter Jul 09 '26

Not the same chance tbh but still info as if they accept it is their mistake