# Attacker can access graphic representation of every query

Widget creation accepted arbitrary query_id; scheduled email export rendered other tenants' query data despite UI authorization blocking it.

- Payout: hidden
- Severity: medium
- Program: Bime
- Found by: jobert
- Disclosed: 2016-07-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/149914
- Library page: https://bugbountylibrary.com/r/h1%3A149914
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:idor

**Target:** /widgets.json endpoint and scheduled email export
**Root cause:** Widget creation did not verify the caller owned the supplied query_id, and the asynchronous email/PDF export path enforced authorization differently than the synchronous UI, rendering data the user could not view.
**Steps:**
1. Sign in as normal user on h1-bugbounty.bime.io and create a dashboard.
2. Intercept `POST /widgets.json` containing `"query_id":1052531`.
3. Change `query_id` to another tenant's query ID and submit.
4. Widget renders empty in UI (authorization blocks sync view).
5. Schedule an email reminder every 5 minutes for the dashboard.
6. Receive PDF/image in inbox containing the actual foreign query data.
**How found:** Noticed query_id is a client-supplied sequential identifier in the widget creation request; observed UI blocked rendering but suspected the async export path might not share the same authorization, and tested by scheduling an email.
**Exploitation:** Attacker enumerates query_id values in widget creation, then uses the scheduled email export to bypass the UI-side authorization check and exfiltrate other customers' dataset results as PDF/image attachments.
**Insight:** When a UI blocks an object reference, test alternate rendering paths (async jobs, exports, emails, PDF generators) for the same object — authorization is often reimplemented or omitted there.