# Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure

Fizzy import flow mints signed sgids for attacker-supplied gids without tenant checks, letting an attacker reference and render another account's ActionText attachments.

- Payout: hidden
- Severity: low
- Program: Basecamp
- Found by: xavlimsg
- Disclosed: 2026-04-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3543475
- Library page: https://bugbountylibrary.com/r/h1%3A3543475
- Tags: area:web3 domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:low tech:ruby technique:source-review vuln:access-control vuln:idor

**Target:** app.fizzy.do account import ZIP / ActionText rich text
**Root cause:** convert_gids_to_sgids resolves gid values globally and mints sgids without verifying the resolved record's account_id matches the importing account, unlike the export path which checks ownership.
**Steps:**
1. Clone fizzy repo and `bundle install`
2. Craft import ZIP with ActionText HTML containing a victim record's `gid` in an attachable reference
3. Run `bundle exec ruby security-poc/integration_test_standalone.rb` (or Path B `rails runner security-poc/demo_import_cross_account_impact.rb`)
4. Observe `imported.account_id` = attacker, `resolved_account_id` = victim, `attachable_text` = victim secret
**How found:** Code review of the import path versus export path: noticed export enforces `record&.account_id == account.id` at line 69 while convert_gids_to_sgids (lines 83-89) lacks the same ownership check.
**Exploitation:** Attacker uploads an account import ZIP whose ActionText attachment HTML embeds a gid belonging to a victim tenant; import_batch resolves it globally and persists an sgid, so the victim's attachable content renders in the attacker's account.
**Insight:** When a codebase has parallel import/export or read/write paths for the same signed-reference logic, diff their authorization checks — the missing check in one sibling path is the bug.