# Access MoPub Reports Data even after Company removed you from their MoPub Account.

Removed MoPub users retained API key access to company reporting data because offboarding never reset the Reporting API key.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: suyog
- Disclosed: 2019-11-05
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/399174
- Library page: https://bugbountylibrary.com/r/h1%3A399174
- Tags: area:web domain:api domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** MoPub Reporting API (download_report endpoint)
**Root cause:** Removing a user from the account does not revoke or rotate the Reporting API key, and disabling API data access does not invalidate existing keys.
**Steps:**
1. Get invited to a company's MoPub account with any role and accept.
2. Enable API data access in Reports page (or note it already enabled).
3. Record Reporting API access details: API key, inventory report ID, campaign report ID, and other report IDs.
4. Get removed from Manage User settings by the company.
5. Send `GET https://app.mopub.com/reports/custom/api/download_report?report_key=[REP_KEY]&api_key=[API_KEY]&date=[YYYY-MM-DD]` using the saved key.
6. Follow the 302 Location header to download the CSV report despite no longer being a member.
**How found:** Researcher noted the Reporting API uses a static API key and hypothesized that user removal wouldn't rotate it, then tested access after being removed.
**Exploitation:** A removed user replays the previously captured API key against the download_report endpoint with known report IDs to fetch current and future CSV reports, bypassing account removal.
**Insight:** When a product issues long-lived API keys per-account, test whether offboarding a user (or toggling the feature off) actually rotates/revokes those keys — stale credentials often survive membership changes.