# Disclosure of external users invited to a specific report

HackerOne DELETE endpoint on report external_users leaked membership via 404 vs 500 status codes, letting attackers enumerate external researchers on private reports.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: kirils
- Disclosed: 2016-09-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/157699
- Library page: https://bugbountylibrary.com/r/h1%3A157699
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:rest technique:recon vuln:access-control vuln:info-disclosure

**Target:** HackerOne report external_users DELETE endpoint
**Root cause:** The DELETE /reports/{id}/external_users/{user_id} endpoint returned 404 when the user was an external participant and 500 when not, without first checking the requester's access to the report, creating a membership oracle.
**Steps:**
1. Obtain a valid session and CSRF token from a legitimate user's request.
2. Send `curl 'https://hackerone.com/reports/(report_id)/external_users/(user_id)' -X DELETE` with session cookie, `X-CSRF-Token`, and `X-Requested-With: XMLHttpRequest`.
3. Observe status: 404 = user is external participant; 500 = not; 412 = invalid session.
4. Enumerate user_id from 1000 upward, or harvest IDs from leaderboard/hacktivity or `curl 'https://hackerone.com/(username)'` with JSON Accept header.
**How found:** Noticed the DELETE endpoint returned inconsistent status codes (404 vs 500) rather than a uniform authorization error, indicating a membership side channel.
**Exploitation:** Attacker with any authenticated session probes each candidate user_id against a target private report_id; differing status codes reveal which researchers are external participants, exposing who knows about an unresolved 0day.
**Insight:** Destructive endpoints that return distinct error codes for 'not found' vs 'not permitted' leak object membership; test DELETE/PUT verbs on relationship subresources for status-code oracles even when the action itself fails.