# View Titles of Private Reports with pending email invitation

Unauthenticated GraphQL report(id:) query leaked titles of private HackerOne reports that had a pending email collaborator invitation.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: ahacker1
- Disclosed: 2024-01-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2312029
- Library page: https://bugbountylibrary.com/r/h1%3A2312029
- Tags: area:web domain:api domain:web impact:data-leak kind:bounty platform:hackerone sev:high tech:graphql vuln:access-control vuln:idor vuln:info-disclosure

**Target:** GraphQL report(id) endpoint on hackerone.com
**Root cause:** The report resolver returned title for private reports to anonymous users when a pending email collaborator invitation existed, bypassing the access check that normally gates private reports.
**Steps:**
1. As victim, add a collaborator by email to a private report; note the integer report ID.
2. In a logged-out session, POST to `https://hackerone.com/graphql` with `x-csrf-token` from the hacktivity page.
3. Send `query HacktivitySearchQuery($reportId: Int!){ report(id:$reportId){ id url title } }` with `variables:{"reportId":PRIVATE_REPORT_ID}`.
4. Response returns the private report's title.
**How found:** Researcher likely noticed the report resolver's access logic differed when a pending collaborator invite existed, and tested the GraphQL query from an unauthenticated session.
**Exploitation:** Anonymous attacker enumerates integer report IDs via the GraphQL report query; any private report with a pending email invitation returns its title, disclosing unfixed vulnerability summaries.
**Insight:** Access-control checks on GraphQL object resolvers can diverge by state (e.g. pending invite) — test private-object queries unauthenticated across lifecycle states like pending invitations.