# Stored XSS on developer.uber.com via admin account compromise

Any readme.io user could self-add as admin to Uber's developer.uber.com project via a broken accept-invite endpoint, enabling stored XSS against developers.

- Payout: $5,000
- Severity: high
- Program: Uber
- Credited: albinowax
- Disclosed: 2016-08-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/152067
- Library page: https://bugbountylibrary.com/r/h1%3A152067
- Tags: domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high technique:incomplete-fix technique:source-review vuln:access-control vuln:privilege-escalation vuln:xss

**Target:** readme.io project admin invite API (dash.readme.io)
**Root cause:** The /api/accept-invite endpoint accepted an invite ID without validating that the invite belonged to the requesting user or project, and returned an error while still granting the role.
**Steps:**
1. Fetch `https://uber.readme.io/inactiveand` and extract Uber project ID `578cd33dc27ce20e004e397b` from source
2. Register and verify a normal readme.io account, log in
3. Send `POST /api/accept-invite/5617f98f7f74330d00dfd86d` to `dash.readme.io` with own XSRF token and cookies
4. Server responds 'Invite doesn't exist' but account is now admin of Uber project
5. Visit dash.readme.io, confirm admin access to Uber project
**How found:** Researcher noticed the project ID was exposed in page source and tested whether the accept-invite API validated invite ownership, observing the error response still granted admin.
**Exploitation:** After gaining admin, inject arbitrary JavaScript into developer.uber.com documentation pages (admins can by design), yielding stored XSS to hijack developer accounts.
**Escalation:** Privilege escalation from unauthenticated readme.io user to project admin, then stored XSS on the victim domain.
**Insight:** When an invite/accept endpoint returns an error, always re-check state — servers often commit the role change before failing validation. Project IDs leaked in public page source enable cross-tenant invite abuse.