Skip to content
Good Faith
Queue
DuplicateSettledBounty claim

Able to view notes owned by other accounts

Reportr_64dhf4act2@late_to_the_partyNov 9, 07:58 UTCLantern 1.4.0Researcher view
Claude's recommendation: Duplicateconfidence 93%

This looks like a duplicate of r_6y9btspn6v. Same vulnerability class and primary component as r_6y9btspn6v (similarity 0.93), which was already accepted. Confirm before voiding the deposit.

Suggested severity
medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5)

Claimed severity
—
Vulnerability class
CWE-639
Triage
12 s · claude-opus-5-5 (live)

Duplicate of r_6y9btspn6v

  1. Step 1 done

    Read the claims

    CWE-639 in 1.4.03.4 s
  2. Step 2 done

    Version in scope

    0 ms

    Pass: Version 1.4.0 is in scope

    The project has 1.4.0.

  3. Step 3 done

    Cited code exists

    1 ms

    Pass: File src/notes.ts exists in 1.4.0

    The cited file is present at this version.

  4. Step 4 done

    Not a duplicate

    2.3 s

    Duplicate: Duplicate of r_6y9btspn6v

    Similarity 0.93; same class and component: true.

  5. Step 5 done

    Sandbox replay

    0 ms

    Inconclusive: Skipped replay (duplicate)

    Treated as a duplicate of r_6y9btspn6v; not replayed so the bounty is not paid twice.

  6. Step 6 done

    Assessment

    5.9 s

    Assessment: Slop assessment 0.20

    Version exists and is in scope; no fabricated version or code reference detected Code reference (src/notes.ts, GET /api/notes/:id) did not fail validation Impact is plausible and consistent with the CWE-639 IDOR class Report is terse with no reproduction steps, request/response samples or PoC, so it is unverified rather than fabricated Canary did not reproduce; this alone does not indicate slop

  7. Step 7 done

    Verdict

    0 ms
    Duplicateconfidence 93%suggested severity medium

    This looks like a duplicate of r_6y9btspn6v. Same vulnerability class and primary component as r_6y9btspn6v (similarity 0.93), which was already accepted. Confirm before voiding the deposit.

    Claude: claude-opus-5-5 the AI recommends; only a maintainer moves money.