# Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports

A user with limited report access could close their report as a duplicate of another program's limited-disclosure report, bypassing cross-organization access control.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: akashhamal0x01
- Disclosed: 2024-06-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2516250
- Library page: https://bugbountylibrary.com/r/h1%3A2516250
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:param-pollution vuln:access-control vuln:business-logic vuln:idor

**Target:** POST /reports/bulk endpoint (report bulk-close as duplicate)
**Root cause:** The ACL check `can?(:view, original_report)` returned true for limited-disclosure reports and did not verify the original report belonged to the same organization as the actor.
**Steps:**
1. Create a sandbox program and invite User B with Report and Engagement access.
2. Log in as User B and open any report, choose Close as duplicate to capture the request.
3. Send `POST /reports/bulk` with `substate=duplicate`, `original_report_id=<other program's limited-disclosure report>`, `report_ids[]=<own report>`, valid CSRF token.
4. Observe 200 OK and the report closed as duplicate of the foreign report.
**How found:** Researcher captured the bulk-close-as-duplicate request and substituted the original_report_id with a report from a different program, testing whether cross-org references were validated.
**Exploitation:** An authenticated low-privilege program member submits the bulk-close request referencing a limited-disclosure report ID from another program; the server accepts it and links the attacker's report as a duplicate of the foreign report.
**Escalation:** Attacker can make other programs' public/limited reports appear to have duplicates from unrelated programs, polluting report metadata and potentially disrupting automation pipelines.
**Insight:** When a bulk action references a foreign object ID, test whether the ACL only checks visibility rather than same-tenant ownership; limited-disclosure objects often pass view checks but should not be linkable cross-org.