# Creation of bounties through Customer API leads to private email disclosure

HackerOne Customer API let a sandbox program award a bounty to any user ID, then BountiesHistoryQuery GraphQL leaked that user's private email.

- Payout: hidden
- Severity: critical
- Program: HackerOne
- Found by: 0v3rw4tch
- Disclosed: 2024-03-26
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2382120
- Library page: https://bugbountylibrary.com/r/h1%3A2382120
- Tags: area:web domain:api domain:web impact:pii-leak kind:bounty platform:hackerone sev:critical tech:graphql tech:rest technique:chained vuln:access-control vuln:idor vuln:info-disclosure

**Target:** HackerOne Customer API bounty endpoint and BountiesHistoryQuery GraphQL
**Root cause:** The Customer API bounty creation endpoint accepted an arbitrary recipient_id without verifying the recipient was a program member, and the GraphQL BountiesHistoryQuery exposed awarded_user/invitations email fields to the program.
**Steps:**
1. Create a sandbox program and an API token with report manager role
2. Copy any target user's id from their HackerOne profile
3. POST to `https://api.hackerone.com/v1/programs/{id}/bounties` with Basic auth and body `{"data":{"type":"bounty","attributes":{"recipient_id":"<victim_id>","amount":51,"reference":"newbounty","title":"...","currency":"USD","severity_rating":"high"}}}`
4. Receive success message confirming bounty awarded to victim
5. Send GraphQL `BountiesHistoryQuery` with `handle` of sandbox team requesting `awarded_user{username} invitations{email token}` and `report{reporter{email}}`
6. Observe victim's private email in the response
**How found:** Researcher noticed the API accepted arbitrary recipient_id and that the GraphQL bounty history query exposed email fields on awarded users, then chained the two.
**Exploitation:** Attacker with a sandbox program and API token awards a minimal bounty to any user id, then queries their own program's bounty history via GraphQL to read the recipient's email, repeatable for any user id.
**Insight:** When an API lets you set a foreign key (recipient_id) to an arbitrary object, check whether any read endpoint on your own resource then reflects that object's private fields — write-then-read chains bypass ownership checks.