# Stealing data from customers.gitlab.com without user interaction

Attacker rebinds their customers.gitlab.com account to a victim's GitLab uid via unverified PATCH, hijacking subscriptions and credit card data.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: rpadovani
- Disclosed: 2020-08-26
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/674195
- Library page: https://bugbountylibrary.com/r/h1%3A674195
- Tags: area:web domain:web impact:ato impact:funds-loss impact:pii-leak kind:bounty platform:hackerone sev:high tech:oauth technique:source-review vuln:access-control vuln:account-takeover vuln:business-logic

**Target:** customers.gitlab.com account edit endpoint (PATCH /customers)
**Root cause:** The customer update endpoint accepts an arbitrary `customer[uid]` linking the local account to any GitLab.com user without verifying ownership of that GitLab identity.
**Steps:**
1. Register on customers.gitlab.com and log in via GitLab.com OAuth.
2. Capture the PATCH /customers request from the account edit page.
3. Replay it with `customer[uid]=VICTIM_ID` (uids are sequential/public).
4. Backend validates and links attacker account to victim's GitLab identity.
5. Victim re-login wipes their subscriptions; subsequent victim profile updates overwrite attacker's record including credit card.
**How found:** Noticed uid is a sequential, non-secret field in the update request and tested changing only `customer[uid]`; first attempt changing uid+email failed, isolating uid as the unverified link.
**Exploitation:** Attacker links their portal account to victim's uid, then waits for victim to log in (subscriptions destroyed) and update billing data (credit card copied to attacker). Attacker nominates victim as owner of attacker's group so the group appears in the plan dropdown, buys a plan charged to victim's card, then removes victim.
**Escalation:** Chained IDOR into subscription destruction, credit-card theft, and unauthorized purchases for attacker-controlled groups; also leaks victim's owned teams.
**Insight:** When an account-linking field (uid, external_id) is user-controllable in a profile update, test rebinding to another user's id; sequential public IDs make enumeration trivial and linking often skips ownership proof.