# Stored XSS in [https://streamlabs.com/dashboard#/*goal] pages

Stored XSS in Streamlabs goal Title field lets a shared-access attacker run JS in the victim's dashboard and delete their site via API.

- Payout: hidden
- Severity: low
- Program: Logitech
- Found by: sudi
- Disclosed: 2020-12-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1049012
- Library page: https://bugbountylibrary.com/r/h1%3A1049012
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:low tech:rest technique:chained vuln:access-control vuln:xss

**Target:** Streamlabs dashboard goal settings pages (followergoal/bitgoal/subgoal)
**Root cause:** The goal Title field is stored and rendered into the dashboard DOM without HTML encoding, so a `"><img src=x onerror=...>` payload breaks out of the attribute and executes.
**Steps:**
1. Victim creates Administrator shared-access invitation at `/dashboard#/settings/shared-access`
2. Attacker accepts invite, opens `/dashboard/act-as/{userId}` to access victim dashboard
3. Attacker visits `/dashboard#/followergoal`, sets Title to `"><img src=x onerror=alert()>`
4. Save and reload; alert fires in attacker's act-as session
5. Victim loads the same goal page and the payload executes in their session
**How found:** Researcher noted the dashboard allows inviting other users to one's account, turning a self-stored XSS in goal Title into a cross-user attack; tested attribute breakout payload in the Title field.
**Exploitation:** Attacker with shared access stores a `<script>` payload in the goal Title; when the victim later visits the goal settings page the script runs with the victim's session and issues `DELETE https://streamlabs.com/api/v6/site/everything` with credentials, wiping the victim's site.
**Escalation:** Self-XSS becomes cross-user via the shared-access/act-as feature; payload persists after attacker access is revoked, and escalates from alert to authenticated API calls (site deletion).
**Insight:** Self-XSS in a field becomes exploitable when the app has an act-as/impersonation or shared-access feature — look for invite/act-as flows that let one user render content in another's authenticated dashboard.