# An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed

Hidden GraphQL mutations let a customer create a pentest opportunity and self-advance its status from submitted to in_review/reviewed, bypassing the HackerOne review workflow.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: marvelmaniac
- Disclosed: 2024-01-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2040756
- Library page: https://bugbountylibrary.com/r/h1%3A2040756
- Tags: area:web3 domain:api impact:integrity kind:bounty platform:hackerone sev:medium tech:graphql technique:source-review vuln:access-control vuln:business-logic

**Target:** GraphQL API (hackerone.com/graphql) pentest opportunity mutations
**Root cause:** State-transition mutations (reviewPentestOpportunity, reviewCompletePentestOpportunity) intended for HackerOne reviewers were exposed to the client role without authorization checks, so a customer could drive their own opportunity's status.
**Steps:**
1. Create a demo organization on hackerone.com and capture cookies, X-Csrf-Token, and organization_id from Burp history.
2. POST /graphql with mutation `createPentestOpportunity(input:{company_name, customer_email, organization_id, name})` to create an opportunity; note returned id and token.
3. POST /graphql with mutation `reviewPentestOpportunity(input:{pentest_opportunity_id:"<ID>"})` to move status from submitted to in_review.
4. POST /graphql with mutation `reviewCompletePentestOpportunity` to move status directly to reviewed.
5. Observe the opportunity and derived pentest appear under the org's engagements/pentest tab in pending-review state.
**How found:** Researcher ran a GraphQL introspection query and spotted three interesting mutations: createPentestOpportunity, reviewPentestOpportunity, reviewCompletePentestOpportunity. Since no UI existed to create opportunities, they tried invoking the mutations directly and found the status transitions worked from the client side.
**Exploitation:** Authenticated customer enumerates GraphQL introspection, finds reviewer-only mutations, and invokes them with their own session to create and self-advance a pentest opportunity, causing HackerOne's pentest team to receive and process dummy/unauthorized engagements.
**Insight:** GraphQL introspection often reveals mutations for reviewer/admin state transitions that the UI never exposes; try invoking them with a low-privilege session to test whether authorization is enforced server-side rather than only hidden in the frontend.