# Fetch private list metadata and any user's personal name

Instacart's star_toggle and lists endpoints leaked private list metadata and any user's real name via incremental IDs, bypassing visibility and name-hiding settings.

- Payout: $150
- Severity: medium
- Program: Instacart
- Credited: sameoldstory
- Disclosed: 2016-09-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/162822
- Library page: https://bugbountylibrary.com/r/h1%3A162822
- Tags: domain:api impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:rest vuln:idor vuln:info-disclosure

**Target:** REST API endpoints /api/v2/lists/10/star_toggle and /api/v2/lists?user_id=
**Root cause:** The star_toggle response returns full list metadata (including user_name) without checking the list's visible flag or the owner's show-name preference; the lists index endpoint returns author_name for any user_id regardless of privacy settings.
**Steps:**
1. Victim creates a list with 'visible in search' and 'show my name' unchecked, then shares the link.
2. Attacker POSTs to `/api/v2/lists/10/star_toggle` to favorite the list.
3. Response body includes `visible: false` but still returns `user_name`, `name`, `description`, images.
4. Enumerate incremental list IDs to dump metadata for all lists.
5. Separately, `GET /api/v2/lists?user_id=10` returns `author_name` even when the user has zero lists; enumerate user_id to harvest names.
**How found:** Researcher noticed the privacy toggles (visible-in-search, show-name) and tested whether the star_toggle response honored them; observed the response still contained user_name and other hidden fields. Then probed the lists index with an arbitrary user_id and saw author_name returned even with empty data.
**Exploitation:** Attacker needs a valid account and either a shared list link or just iterates incremental list IDs / user IDs. Each star_toggle call returns private metadata; the lists index returns the personal name for any user_id, enabling mass enumeration of names.
**Escalation:** Incremental IDs allow scaling from a single shared list to dumping metadata for all Instacart lists and personal names for all users.
**Insight:** Privacy toggles enforced on read endpoints are often not enforced on side-effect endpoints (favorite/star/like) that return the same object — test every mutation endpoint that echoes the resource. Also test index endpoints with a foreign user_id to see if author metadata leaks even when the collection is empty.