# Ticket Trick Attack allows access to ████████' workspaces

Support portal accepted unverified email signups, so attacker registered a victim's email and read their password-reset/login-link tickets to hijack accounts.

- Payout: hidden
- Severity: high
- Program: Rockstar Games
- Found by: recon_ninja
- Disclosed: 2026-09-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1534465
- Library page: https://bugbountylibrary.com/r/h1%3A1534465
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high technique:chained vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** Support portal / helpdesk ticketing system
**Root cause:** Support portal did not verify ownership of an email address before allowing signup and access to tickets associated with that email, so inbound emails to the victim address became readable tickets.
**Steps:**
1. Victim org has account on organisation.com with email victim@x.
2. organisation.com sends login link from no-reply@x to victim@x.
3. Attacker signs up on the support portal using victim@x without email verification.
4. Attacker logs into support portal as victim@x.
5. Attacker triggers login link request on organisation.com for victim@x.
6. Email arrives at victim@x and is auto-ingested as a support ticket visible in attacker's dashboard.
7. Attacker reads the login link from the ticket and logs in as victim.
**How found:** Observation that the support portal ingests inbound email as tickets and never verifies email ownership at signup; hypothesis that any email sent to an unverified address becomes readable.
**Exploitation:** Attacker registers the victim's email on the support portal, triggers a password-reset/login-link email to that address, reads the link from the resulting ticket in the dashboard, and uses it to authenticate as the victim on the target site.
**Escalation:** Chained across any site sending login/reset links to the victim address, enabling account takeover and password resets on multiple services.
**Insight:** Helpdesk/support portals that auto-create tickets from inbound email are a ticket-trick vector: test whether you can register an arbitrary victim email without verification and then read password-reset emails routed into your dashboard.