# Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report

Stale report subscribers who left a program still received in-app notifications when a report was transferred, leaking report existence to unauthorized ex-members.

- Payout: $500
- Severity: low
- Program: HackerOne
- Credited: npbhatter17
- Disclosed: 2018-12-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/442843
- Library page: https://bugbountylibrary.com/r/h1%3A442843
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:low technique:chained technique:incomplete-fix vuln:access-control vuln:info-disclosure

**Target:** Report transfer notification / subscriber relationship
**Root cause:** When a user left a program, their User object was not removed from the Report.subscribers relationship, so notification logic iterated stale subscribers lacking current access.
**Steps:**
1. User is added to Report.subscribers (auto or manual) while a program member
2. User is removed from the program; TeamMember::Destroy does not clean subscribers
3. Another member transfers the report to a different program
4. Notification is generated for all Report.subscribers including the removed user
5. Removed user sees in-app notification of the transferred report
**How found:** Researcher noticed they could still see program details after authenticating via SAML, recognized it resembled a previously rejected report (438306), and re-reported the recurring authorization gap.
**Exploitation:** Precondition: attacker was previously a program member (or added via the SAML JIT incident) and retained a stale subscriber relationship. When a legitimate member transferred a report, the attacker received an in-app notification revealing the report's existence/transfer.
**Escalation:** Chained with the prior SAML JIT incident (report 438306) which had added many users as subscribers across programs, amplifying the leak to 2110 notifications across 21 programs.
**Insight:** Membership-removal logic often cleans the membership record but not denormalized subscriber/follower relationships on child objects; audit every place a user is denormalized onto a resource when offboarding, and check notification fan-out paths for stale recipients.