# Authorization Bypass in Delivery Chat Logs

Instacart mobile API order_change_logs endpoint lacked ownership checks, letting any user read other orders' delivery chat logs and Firebase tokens by changing the order_delivery_id.

- Payout: $100
- Severity: medium
- Program: Instacart
- Credited: michiel
- Disclosed: 2016-11-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/144000
- Library page: https://bugbountylibrary.com/r/h1%3A144000
- Tags: domain:api domain:mobile impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:rest technique:recon vuln:access-control vuln:idor vuln:info-disclosure

**Target:** Mobile app REST API endpoint /api/v2/order_deliveries/:id/order_change_logs
**Root cause:** The order_change_logs endpoint returned chat logs and order data for any order_delivery_id without verifying the requesting user owned that delivery.
**Steps:**
1. Intercept iPhone app traffic in Burp Suite
2. Tap 'View Chat Logs' on a past order to capture `GET /api/v2/order_deliveries/261932226/order_change_logs`
3. Change the ID to another user's delivery (e.g. `261972220`) and resend
4. Observe JSON chat logs and order data returned for orders not belonging to the attacker
5. Extract Firebase tokens from response and query `https://instacart.firebaseio.com/order_deliveries/<id>.json`
**How found:** Researcher proxied the mobile app, noticed the chat-log button issued a numeric-ID GET request, and tested ID substitution to check for missing ownership enforcement.
**Exploitation:** Authenticated attacker iterates/enumerates sequential order_delivery_id values to harvest other users' chat logs, order change details, and Firebase tokens; Firebase tokens did not yield further access in this report.
**Escalation:** Potential pivot via leaked Firebase tokens to instacart.firebaseio.com order_deliveries paths, though no further impact demonstrated.
**Insight:** Mobile app 'view logs/history' buttons often hit numeric-ID endpoints that skip ownership checks; proxy the app and swap IDs on every object-scoped GET, and check responses for embedded third-party tokens (Firebase) that may widen impact.