# Unauthenticated users can access all food.grammarly.io user's data

Unauthenticated Meteor publications on food.grammarly.io exposed 300+ employees' emails, Okta/Google OAuth tokens, and admin flags via browser console.

- Payout: hidden
- Severity: low
- Program: Superhuman (formerly Grammarly)
- Found by: cript0nauta
- Disclosed: 2020-08-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/745495
- Library page: https://bugbountylibrary.com/r/h1%3A745495
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:low tech:websocket technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Meteor web app (food.grammarly.io) publications/methods
**Root cause:** Meteor publications and methods lacked authentication checks, so the client could subscribe to any publication and read collections without a session.
**Steps:**
1. Visit https://food.grammarly.io and open Chrome DevTools console
2. Run `Meteor.subscribe('activeUsers')`
3. Wait, then run `Meteor.users.find().forEach(e => console.log(e))`
4. Observe emails, Okta/Google OAuth tokens, hashed login tokens, admin status; repeat with other publications like `allUsers`, `allVendors`, `foodSettings`
**How found:** Recognized the site runs Meteor, then tested whether publications/methods enforce auth by subscribing from the DevTools console without logging in.
**Exploitation:** Attacker loads the public site unauthenticated, subscribes to exposed Meteor publications from the console, and dumps collections including Meteor.users with OAuth tokens and admin flags. Tokens were not usable for high-impact access per the reporter.
**Escalation:** Reconnaissance value: identifying admin employees for targeted attacks; no further escalation achieved.
**Insight:** When a target runs Meteor, enumerate publication names (often visible in client JS bundles) and try `Meteor.subscribe('<name>')` unauthenticated; publications are frequently left without auth checks even when the UI gates access.