# IDOR in "external status check" API leaks data about any status check on the instance

IDOR in GitLab external status check response API lets any user enumerate status check configs, leaking private project names, URLs, and protected branch access rules.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: joaxcar
- Disclosed: 2022-02-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1372216
- Library page: https://bugbountylibrary.com/r/h1%3A1372216
- Tags: area:web domain:api domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:rest vuln:access-control vuln:idor vuln:info-disclosure

**Target:** POST /projects/:id/merge_requests/:iid/status_check_responses API endpoint
**Root cause:** The external_status_check_id parameter is not scoped to status checks belonging to the target project, so any ID resolves and returns that check's configuration.
**Steps:**
1. Create attacker project and MR, note project ID as ATTACKID
2. Create personal access token TOKEN
3. POST `/api/v4/projects/<ATTACKID>/merge_requests/1/status_check_responses?sha=a&external_status_check_id=2` with Bearer TOKEN to learn correct SHA from error
4. Resend with correct sha to get MR info plus status check config
5. Change external_status_check_id to another ID (e.g. 1) to leak a victim's private status check config
**How found:** Noticed the response body echoed status check configuration and that the ID parameter was user-controlled; hypothesized it wasn't scoped to the project and tested by swapping IDs.
**Exploitation:** Authenticated user with an Ultimate trial creates their own project/MR, then iterates external_status_check_id values in the status_check_responses request to dump configuration of arbitrary status checks across the instance, including private projects.
**Insight:** When an API response embeds a related object's full config, try swapping that object's ID across tenants/projects—look for endpoints where a nested resource ID is accepted alongside a parent you control.