# Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate

Sequential numeric giftId on Udemy /gift/share exposed other users' gift recipient name, email, and redemption code, allowing free redemption.

- Payout: hidden
- Severity: high
- Program: Udemy
- Found by: caffeinewriter
- Disclosed: 2017-03-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/119166
- Library page: https://bugbountylibrary.com/r/h1%3A119166
- Tags: area:web domain:web impact:data-leak impact:funds-loss impact:pii-leak kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:business-logic vuln:idor

**Target:** /gift/share/ endpoint with giftId parameter
**Root cause:** The gift share endpoint used sequential numeric gift IDs and did not require authentication or ownership checks, so any gift could be viewed and its redemption code extracted by enumerating IDs.
**Steps:**
1. Start from a valid share URL like `https://www.udemy.com/gift/share/?giftId=559076`.
2. Increment or decrement `giftId` by 2, e.g. `https://www.udemy.com/gift/share/?giftId=559078`, to view another user's gift.
3. Extract the exposed redemption code from the page.
4. Add `couponCode` parameter with that code on a course page, or enter it in the "Redeem a Coupon" box.
5. Check out to redeem another person's gift for free.
**How found:** Researcher purchased a gift, noticed the share URL gift ID was simply numeric, and tried incrementing/decrementing by 2 to reach other gifts.
**Exploitation:** Attacker enumerates giftId values on the unauthenticated share endpoint, harvests recipient name/email and the gift redemption code, then applies the code at checkout to redeem the gift for free on an unrelated account.
**Insight:** Gift/coupon share pages that expose redemption codes should be checked for sequential IDs and missing auth; try small offsets (±1, ±2) since adjacent IDs may map to other records.