# How I hacked Google’s bug tracking system itself for $15,600 in bounties

Google Issue Tracker's bulk_edit endpoint lacked access control on issueIds, leaking full details of every internal bug including vulnerability reports.

- Payout: $15,600
- Severity: critical
- Program: Google
- Credited: Alex Birsan
- Disclosed: 2017-10-30
- Write-up quality: 8/10
- Original: https://medium.freecodecamp.org/messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5
- Library page: https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical tech:rest technique:js-analysis vuln:access-control vuln:idor vuln:info-disclosure

**Target:** Issue Tracker web app /action/issues/bulk_edit REST endpoint
**Root cause:** The bulk_edit REMOVE action never verified the caller had access to the issueIds, silently succeeded on non-CC emails, and a downstream component then returned full issue details assuming permissions were checked.
**Steps:**
1. Authenticate as an external user on Google Issue Tracker.
2. Send `POST /action/issues/bulk_edit` with body `{"issueIds":[67111111,67111112],"actions":[{"fieldName":"ccs","value":"test@example.com","actionType":"REMOVE"}]}`.
3. Replace issueIds with arbitrary/sequential IDs; response body returns full details of each issue.
4. Batch many IDs per request to exfiltrate at scale without tripping rate limits.
**How found:** Noticed the external UI still exposed a CC-removal bulk_edit API endpoint in JS; observed it returned success even for issues/emails the user had no rights to, then checked the response body and found full issue details leaked.
**Exploitation:** Any external account could enumerate sequential issue IDs and pull full contents of internal Buganizer tickets, including vulnerability reports, in bulk via a single POST per batch.
**Escalation:** Batching multiple issueIds per request enabled mass exfiltration of the entire tracker in real time without rate-limit triggers.
**Insight:** When a UI hides privileged actions, grep the JS for the underlying API and test whether the server enforces the same access checks the UI implies; silent-success responses on unauthorized objects often precede a downstream component trusting that check.