Bug ReportResolvedHighother

User ID poses security risk

GCGraciano Castillo Jr-8 days ago(edited)

Sequential or guessable IDs make it trivial to enumerate all user accounts and scrape user profiles — a common IDOR (Insecure Direct Object Reference) risk.

Steps to Reproduce

1. Go to leaderboards 2. It exposes predictable user IDs in the URL

Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Device: MacIntel | 1920x1080

Discussion (0)

Please sign in to leave a comment

Status History

RR

Ranny Randolfchanged status toIn Progress

7 days ago

RR

Ranny Randolfchanged status toResolved

7 days ago