# Authorization bypass in Google’s ticketing system (Google-GUTS)

Google-GUTS ticketing system accepted emails to ext-ticket@google.com with a sequential 8-digit ticket ID in the subject, letting anyone update any supplier's ticket including banking data.

- Payout: $1,337
- Severity: high
- Program: Google
- Credited: Zohar Shachar
- Disclosed: 2020-07-28
- Write-up quality: 6/10
- Original: https://www.ehpus.com/post/authorization-bypass-in-google-s-ticketing-system
- Library page: https://bugbountylibrary.com/r/blog%3Aehpus-com-post-authorization-bypass-in-google-s-ticketing-system
- Tags: domain:web impact:funds-loss impact:integrity impact:pii-leak kind:bounty platform:blog sev:high tech:email technique:recon vuln:access-control vuln:auth-bypass vuln:idor

**Target:** Email-driven ticketing system (Google-GUTS) for VRP supplier enrollment
**Root cause:** Ticket updates are plain emails to ext-ticket@google.com; the system identifies the ticket solely by a sequential 8-digit ID in the subject and performs no authorization check on the sender.
**Steps:**
1. With alice@gmail.com send an email to ****vrp@google.com to create a supplier ticket.
2. Alice receives an email from ext-ticket@google.com with subject containing ticket ID t/XXXXXXXX (8 sequential digits).
3. With bob@gmail.com send an email to ext-ticket@google.com with subject `t/XXXXXXXX` and a malicious body (e.g., request bank details be sent to Bob's address).
4. Alice's ticket is updated with Bob's request and Alice receives the update notification from ext-ticket@google.com.
**How found:** Noticed the process was 'loose' between steps 2 and 3: an email to one address (****vrp@google.com) triggers a ticket in a different system (ext-ticket@google.com) that is updated by replying to email. Hypothesized no whitelist and wondered how the ticket is identified, then tested that the subject's 8-digit ID is sequential and unauthenticated.
**Exploitation:** Attacker enumerates sequential ticket IDs and emails ext-ticket@google.com with a target ticket ID in the subject and a crafted body, injecting requests into another supplier's ticket to redirect payout/banking data or harvest PII.
**Escalation:** Sequential IDs allow enumeration across all supplier tickets, enabling mass tampering with banking details to steal bounties.
**Insight:** Email-to-ticket gateways that key off a subject-line ID are a classic authz gap: check whether the inbound address enforces a sender whitelist and whether IDs are sequential/enumerable, then test cross-account ticket updates.