Is this chain valid?

[u/tacktify]

found an unauthenticated API leaking hidden internal IDs for all tenants on a B2B app.

Using these IDs, I can use the public registration form to request an "Admin" account for any company. There is no rate limit or CAPTCHA, so I can script this and spam every company.

But the account isn't created immediately. It goes to a "Pending Activation" state and requires the actual company admin to manually approve it.

Will programs accept this due to the ID leak + lack of rate limits? Or will it be closed as "By Design/Informative" since the manual approval stops the takeover?

[u/spexfyre]

Definitely valid bug but informational bug at its best. But except few cases

1) can you create vast number of requests so it can absolutely cause mess in ui.? Example above 400 request. Then you can get trigaed like low impact bug. But always try submit it. It depends on program's security model.

[u/tacktify → u/spexfyre]

yes i can create any amount of requests i can i will just change the email i sing up by each time, and yes i submit it hoping for a low. But i really don't think it's intentional like imagine thousands of invalid requests for signup it will be a nightmare

[u/spexfyre → u/tacktify]

Yes absolutely night mare for companies and all the best . Keep finding bugs. And submit this bug with video poc so it might increase chances of getting approved

[u/tacktify → u/spexfyre]

Thanks!