# Disclose any user's private email through API

Adding any user as a report participant then fetching the report via API leaked the invited user's private email in the activities object.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: zombiehelp54
- Disclosed: 2017-02-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/196655
- Library page: https://bugbountylibrary.com/r/h1%3A196655
- Tags: area:web domain:api impact:pii-leak kind:bounty platform:hackerone sev:medium tech:rest vuln:access-control vuln:info-disclosure

**Target:** HackerOne reports API (/v1/reports/{id})
**Root cause:** The report activities serialization includes the invited external user's email in the activity-external-user-invited object without redacting it for the report owner/API consumer.
**Steps:**
1. Create a sandbox program and a report under it.
2. Add the victim username as a participant to the report.
3. Generate an API token.
4. Fetch the report via `curl "https://api.hackerone.com/v1/reports/[report_id]" -u "api_idetifier:token"`.
5. Observe the victim's email in `activities.data[].attributes.email` of the `activity-external-user-invited` entry.
**How found:** Noticed the API response's activities object exposed the invited user's email field when adding a participant.
**Exploitation:** Attacker with a program adds any target username as participant, then reads the report via API to harvest the private email from the activities object.
**Insight:** When a feature invites external users, check whether the inviter's own API view of the resulting activity object leaks the invitee's PII (email) that the UI hides.