# Users can bypass page restrictions via Export feature at "Share" feature in CrowdSignal

CrowdSignal share links restricted to the Results page still allowed exporting Overview, Locations, and Participants pages via direct .xlsx URLs.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: bugra
- Disclosed: 2020-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/915140
- Library page: https://bugbountylibrary.com/r/h1%3A915140
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:idor

**Target:** Share feature export endpoints (/share/{token}/*.xlsx)
**Root cause:** Export endpoints did not enforce the per-page access restrictions configured in the Share feature, only checking share-token validity.
**Steps:**
1. Create survey with upgraded account, open Results > Share
2. Grant a user access to Results page only, enable Export, save
3. Open the shared survey link from email
4. Request `https://app.crowdsignal.com/share/(surveytoken).xlsx` to export Overview
5. Request `/share/(surveytoken)/locations.xlsx` and `/share/(surveytoken)/participants.xlsx` to export restricted pages
**How found:** Noticed the Share feature offers an Export toggle alongside page restrictions, hypothesized export endpoints might not honor the page allowlist, and tried the predictable .xlsx URL patterns.
**Exploitation:** A share recipient with Results-only access directly requests the export URLs for other pages, downloading restricted survey data as xlsx.
**Insight:** When an access-control UI combines a page allowlist with a separate export toggle, test whether export endpoints enforce the page allowlist or only token validity; predictable path-based export URLs (/share/{token}/{page}.xlsx) are prime targets.