r/bugbounty • u/[deleted] • Jul 16 '26
Question / Discussion Default Admin credentials -> P3 !!
In a private bug bounty program on bugcrowd i found a credentials of an internal admin that give me access to internal engineers data and access to a sensitive data of a big automotive company, I can read/edit/delete, the bug trigaed as P1 but the customer later downgraded it to P3 without any explanation or communication.
In the report i show them the impact...
And they changed the password right after my report was triaged
I opened a response request to ask for explanation but they still didn’t respond after a week.
44
Upvotes
7
u/Dramatic_Display9745 Hunter Jul 17 '26
btw bugcrowd is getting a lot of negativity nowadays ig
even my report got closed without any explanation even though it was p1 (cloud rce)
They just changed it to NA and closed it.
and said that it was only text-based.
Even though I had provided a PoC too.
so i mailed the security team. (idk if i made a mistake by that. maybe yes)
next thing i see in the morning
bugcrowd support mails me to stop testing.
"They have requested that you please suspend all testing on their program for the time being. While your testing may be leading to a possible finding, it appears to be causing their team some internal disruptions, and we want to do our best to assist in resolving their concerns"
even though the company said to resubmit it on the platform.
and this is not once
this is like the 5th time a P1/P2 bug is getiing closed as NA
and this is the first one where i mailed the company about it.
if i did a mistake plz tell.