# Email address of any user can be queried on Report Invitation GraphQL type when username is known

GraphQL addReportParticipant mutation returned the invited user's email when inviting by username, leaking PII of any HackerOne user.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: msdian7
- Disclosed: 2020-02-20
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/792927
- Library page: https://bugbountylibrary.com/r/h1%3A792927
- Tags: area:web domain:api domain:web impact:pii-leak kind:bounty platform:hackerone sev:high tech:graphql technique:regression vuln:access-control vuln:info-disclosure

**Target:** GraphQL API mutation addReportParticipant
**Root cause:** When migrating the invitation object from REST to a new GraphQL protection layer, the ACL rule that hid the invited user's email (when invited by username) was not correctly reimplemented, so the mutation response exposed the email field.
**Steps:**
1. Create a test program and a report in it; obtain the report GID (e.g. `gid://hackerone/Report/626371`) and base64-encode it.
2. Send `POST /graphql` with mutation `addReportParticipant` using `{"input_0":{"report_id":"<base64 gid>","email":"<attacker email>","username":"<victim username>"}}` and select `invitation{email,token}`.
3. Read the victim's email from the response `invitation.email`.
**How found:** Reporter noticed the invitation object exposed an email field in the GraphQL response and that inviting by username still returned the resolved email, bypassing the REST-era privacy ACL.
**Exploitation:** Any team member of a demo program could invite an arbitrary platform user by username to a report and read back the invitation's email field in the GraphQL response, disclosing PII without the victim's interaction.
**Insight:** When objects migrate from REST to GraphQL, re-test privacy ACLs on fields that resolve server-side from an identifier (username→email); GraphQL response selection can expose fields the old serializer hid.