# Full access to any list

Instacart's list collaborator endpoint lacked authorization, letting any user add themselves to any private list and edit or delete it.

- Payout: $150
- Severity: high
- Program: Instacart
- Credited: sameoldstory
- Disclosed: 2016-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/173969
- Library page: https://bugbountylibrary.com/r/h1%3A173969
- Tags: domain:api domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:idor vuln:privilege-escalation

**Target:** POST /api/v2/list_users collaborator endpoint
**Root cause:** The add-collaborator endpoint did not verify that the requesting user owned or had access to the target list_id, allowing arbitrary list_id assignment.
**Steps:**
1. Pick a target list id, e.g. `10`.
2. Log in and capture `Cookie` and `X-CSRF-Token` from a request.
3. Send `POST /api/v2/list_users` with body `{"list_user":{"list_id":10,"email":"your@email.com"}}`.
4. Fetch `GET /api/v2/lists/10` to obtain the list token (e.g. `7bHoerQ`).
5. Open `/store/giant/lists/7bHoerQ/edit` to edit/delete the list.
**Exploitation:** Attacker adds their own email as collaborator to any list_id, then uses the returned list token to access the edit UI and modify metadata, items, or delete the list.
**Escalation:** Could be chained with stored XSS by embedding payloads into popular lists, and used for defacement/phishing.
**Insight:** Collaborator/invite endpoints that accept a resource id often skip ownership checks; try adding yourself to arbitrary list/team/project ids and then fetch the resource to harvest its access token.