# Unauthorized access to metadata of undisclosed reports that were retested

GraphQL UserMiniProfile report_retests leaked asset name, type, weakness and severity of undisclosed reports via null report nodes.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: msdian7
- Disclosed: 2020-06-05
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/871749
- Library page: https://bugbountylibrary.com/r/h1%3A871749
- Tags: area:web domain:api domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:graphql vuln:access-control vuln:idor vuln:info-disclosure

**Target:** hackerone.com GraphQL UserMiniProfile query
**Root cause:** The report_retests field on the User node returns retest metadata (asset_name, asset_type, weakness_name, severity_rating) even when the underlying report is undisclosed, exposing report:null nodes with sensitive fields.
**Steps:**
1. Send `POST /graphql` to hackerone.com with operationName UserMiniProfile and username of a user who retested reports.
2. Include the `report_retests{total_count,approved_count,nodes{report{_id},created_at,asset_name,asset_type,award_amount,claimed_at,report_state,weakness_name,severity_rating,report_substate,report_retest_users{...}}}` fragment.
3. Filter response for `"report":null` objects — these correspond to undisclosed reports.
4. Read asset_name, asset_type, weakness_name, severity_rating from those nodes.
**How found:** Noticed the report_retests field returned full metadata even when the nested report object was null (undisclosed), indicating a field-level authorization gap.
**Exploitation:** Query any user's mini profile via GraphQL; retest nodes with null report reveal metadata of undisclosed reports, including asset and severity, without authorization.
**Escalation:** New programs using the retest feature could have their undisclosed report asset/weakness/severity enumerated.
**Insight:** When a GraphQL object nests a protected entity, check whether sibling scalar fields on the parent still populate for unauthorized viewers — null nested IDs with populated metadata signal broken field-level authz.