# Ticket Trick at https://account.acronis.com

Registering an Acronis account with a third-party service's noreply address exposed support tickets containing that service's verification links, enabling account takeover.

- Payout: hidden
- Severity: high
- Program: Acronis
- Found by: sayaanalam
- Disclosed: 2020-11-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/999765
- Library page: https://bugbountylibrary.com/r/h1%3A999765
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:email technique:recon vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** account.acronis.com support ticket system
**Root cause:** Acronis allowed account registration with arbitrary email addresses without verifying ownership, and the support system auto-created tickets from inbound mail to support_mobility@acronis.com that were viewable by the unverified registrant.
**Steps:**
1. Register an Acronis account using a victim service's outbound address (e.g. `noreply@github.com`) without email verification.
2. Trigger the victim service to send a verification/registration email to that address (e.g. register on GitHub with `noreply@github.com`).
3. Acronis support auto-creates a ticket from the inbound email to `support_mobility@acronis.com`.
4. Log into the Acronis account and view the support ticket containing the victim's verification link.
5. Use the link to complete registration/takeover of the victim account.
**How found:** Researcher recognized that support desks auto-ingest inbound email into tickets, and that unverified registration lets an attacker claim a third-party noreply address to read those tickets.
**Exploitation:** Attacker registers on Acronis with a target service's noreply address, induces the service to email that address, then reads the auto-generated support ticket to harvest the verification link and complete account registration on the victim service.
**Escalation:** Applicable to any service sending mail to @acronis.com addresses, including internal Acronis accounts, enabling broad takeover.
**Insight:** Test helpdesk/ticketing ingestion: register with a target's outbound-only address (noreply@, support@) and check whether inbound mail becomes readable tickets, leaking verification or password-reset links.