# Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint

IDOR in HackerOne's /bugs.json search endpoint let any authenticated user query another organization's private reports by ID, leaking titles, URLs, states and reporter names.

- Payout: hidden
- Severity: critical
- Program: HackerOne
- Found by: bate5a
- Disclosed: 2024-05-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2487889
- Library page: https://bugbountylibrary.com/r/h1%3A2487889
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:critical tech:rest vuln:access-control vuln:idor

**Target:** POST /bugs.json report search endpoint
**Root cause:** The /bugs.json search endpoint trusted a client-supplied organization_id and text_query without verifying the caller's membership in that organization, so any authenticated user could search arbitrary orgs' reports.
**Steps:**
1. Authenticate to hackerone.com and capture session cookie and X-Csrf-Token.
2. Send `POST /bugs.json` with body `text_query=1&organization_id=58579&persist=true&sort_type=pg_search_rank&view=message&substates[]=new&...` and headers `X-Requested-With: XMLHttpRequest`, `Content-Type: application/x-www-form-urlencoded`.
3. Observe JSON results containing private reports of org 58579 matching digit '1'.
4. Swap organization_id to any other org ID to enumerate its private reports.
**How found:** Researcher noticed the /bugs.json search endpoint accepted an organization_id parameter and tested whether it enforced org membership by supplying the example org ID from the policy page with a broad single-digit text_query.
**Exploitation:** Any logged-in HackerOne user submits the crafted POST with an arbitrary organization_id and a single-digit text_query; the endpoint returns matching private reports from that org, leaking title, url, id, state, substate, severity_rating, readable_substate, created_at, submitted_at and reporter_name.
**Insight:** Search/autocomplete JSON endpoints that take an org/tenant ID plus a free-text query are prime IDOR targets: try the example IDs published in program policies and use single-character queries to maximize result coverage.