# A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disable

Disabled Bugzilla accounts' API keys kept authenticating on Mojolicious /rest/ routes, letting offboarded users read security-restricted bugs and reassign them via component edits.

- Payout: $4,000
- Severity: high
- Program: Mozilla
- Found by: timhaines
- Disclosed: 2026-10-26
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/4000084
- Library page: https://bugbountylibrary.com/r/h1%3A4000084
- Tags: area:web domain:api domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Bugzilla REST API (Mojolicious /rest/ V1 routes)
**Root cause:** The Mojolicious `bugzilla.login` helper serving native /rest/ routes authenticated API keys without calling `is_enabled`, unlike the legacy rest.cgi and web UI. Disabling an account deleted login cookies but left API keys and group memberships intact.
**Steps:**
1. Obtain an API key for an account that is a member of a security group.
2. Have the account disabled (offboarded, banned, or self-closed); cookies are deleted but the key persists.
3. Call native routes such as `GET /rest/search/*` with the key; authentication succeeds despite the disable.
4. Read security-restricted bugs, including ones filed after the disable.
5. Use `PUT /rest/component` to set a component's triage owner or CC list to a second account never in the security group, exposing restricted bugs to it.
**How found:** Noticed BMO had two authentication implementations; compared legacy rest.cgi/web UI (which refused disabled accounts) against the Mojolicious bugzilla.login helper and found it never called is_enabled.
**Exploitation:** A holder of a pre-disable API key continues to authenticate on native /rest/ routes, reading security-group bugs filed after the disable and writing component metadata via PUT /rest/component to hand restricted bugs to an outside account.
**Escalation:** Writing component triage owner/CC via PUT /rest/component leaks restricted bugs to a second account that was never in the security group.
**Insight:** When a product has parallel auth stacks (legacy CGI vs newer framework routes), diff their account-state checks: disable/logout logic often clears cookies but leaves API keys and group memberships, so test keys minted before disable against every route family.