# [acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosure

Unauthenticated Aura API call to Salesforce Event object with loose guest permissions leaked other users' internal meeting records.

- Payout: hidden
- Severity: low
- Program: Acronis
- Found by: amsda
- Disclosed: 2021-08-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1023572
- Library page: https://bugbountylibrary.com/r/h1%3A1023572
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:low tech:rest technique:recon vuln:access-control vuln:info-disclosure

**Target:** Salesforce Aura API endpoint /acc/aura (Event object)
**Root cause:** Salesforce org granted guest user profile read access to the Event object without record-level security, so the Aura SelectableListDataProviderController returns all records to unauthenticated callers.
**Steps:**
1. Capture a POST to `/s/sfsites/aura` from any Salesforce Lightning site in Burp.
2. Change Host/target to `acronis.secure.force.com` and path to `/acc/aura`.
3. Replace the `message` param with `{"actions":[{"id":"123;a","descriptor":"serviceComponent://ui.force.components.controllers.lists.selectableListDataProvider.SelectableListDataProviderController/ACTION$getItems","callingDescriptor":"UNKNOWN","params":{"entityNameOrId":"Event","layoutType":"FULL","pageSize":100,"currentPage":0,"useTimeout":false,"getCount":false,"enableRowActions":false}}]}`.
4. Send request; response returns Event records of other users.
**How found:** Researcher noticed the target runs Salesforce and tested the Aura API with built-in Lightning controller methods, discovering the Event object was readable by guest users.
**Exploitation:** Unauthenticated attacker sends a crafted Aura getItems action naming the Event entity; the controller returns up to pageSize records per request, allowing enumeration of internal meetings and user data.
**Insight:** On Salesforce Community/Experience sites, replay the standard Lightning `SelectableListDataProviderController/ACTION$getItems` Aura action against `/aura` or `/s/sfsites/aura` with `entityNameOrId` set to objects like Event, Contact, or custom objects to test guest-profile object permissions.