# User with no permissions can access full wdcalendar feed

A staff account with zero permissions could fetch the wdcalendar datafeed endpoint and receive the full appointment calendar including patient PII and billing data.

- Payout: hidden
- Severity: high
- Program: drchrono
- Found by: yaworsk
- Disclosed: 2016-11-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/141541
- Library page: https://bugbountylibrary.com/r/h1%3A141541
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:idor vuln:info-disclosure

**Target:** wdcalendar datafeed endpoint (/wdcalendar/datafeed/<office_id>)
**Root cause:** The wdcalendar datafeed endpoint authenticates the session but never checks the user's calendar/permission grants, so any logged-in staff account can request any office's feed.
**Steps:**
1. Create a doctor's account and add a staff member with no permissions.
2. As the doctor, browse the calendar through a proxy (Burp) and capture the wdcalendar feed URL, e.g. `https://1337test.drchrono.com/wdcalendar/datafeed/105756?method=list&showdate=5%2F27%2F2016&viewtype=examroom&timezone=0&doctors[]=99120`.
3. Log out and log in as the no-permission staff member.
4. Paste the captured feed URL into the browser.
5. Observe the full calendar JSON returned with all appointments and patient details.
**How found:** While browsing as a no-permission user, the researcher noticed the site issuing a wdcalendar datafeed call and tried replaying that URL under the restricted account, which returned the full feed.
**Exploitation:** Any authenticated low-privilege staff member replays the captured datafeed URL (office id and doctors[] params) to retrieve the entire office calendar, exposing patient names, chart IDs, birthdays, gender, age, insurers, billing status and appointment notes.
**Insight:** Calendar/feed endpoints that take office_id and doctors[] as parameters are prime IDOR/authz targets: capture the URL as a privileged user, then replay it as the lowest-privilege account to test whether authorization is enforced server-side.