Skip to content
Good Faith
Queue
ReproducedSettledBounty claim

IDOR: read another user's note

Reportr_6y9btspn6v@mkdir_pNov 9, 07:58 UTCLantern 1.4.0Researcher view
Claude's recommendation: Reproducedconfidence 98%

Reproduced on 1.4.0: the PoC leaked Bob's private note to an account that should not see it. Suggested severity: high. Review the evidence and pay the bounty if you agree.

Suggested severity
high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5)

Claimed severity
high
Vulnerability class
CWE-639
Triage
9.9 s · claude-opus-5-5 (live)
  1. Step 1 done

    Read the claims

    CWE-639 in 1.4.04.2 s
  2. Step 2 done

    Version in scope

    0 ms

    Pass: Version 1.4.0 is in scope

    The project has 1.4.0.

  3. Step 3 done

    Cited code exists

    4 ms

    Pass: File src/notes.ts exists in 1.4.0

    The cited file is present at this version.

  4. Step 4 done

    Not a duplicate

    0 ms
  5. Step 5 done

    Sandbox replay

    2 ms
    Canary hit: Bob's private note reached alice
    {
  "note": {
    "id": "note_2",
    "ownerId": "bob",
    "title": "Recovery phrase",
    "body": "Bank recovery phrase: [CANARY:note]",
    "visibility": "private",
    "updatedAt": "2026-01-01T00:00:00.000Z"
  }
}

    Pass: The PoC reproduced in the sandbox

    A seeded canary (Bob's private note) reached an account not entitled to it.

  6. Step 6 done

    Assessment

    5.7 s

    Pass: Slop assessment 0.02

    Canary reproduced (canary_hit: true): the IDOR was confirmed, so the report is not slop. Claimed version exists and is in scope, and the code reference resolved without failure. Impact is plausible and matches the vulnerability class (CWE-639, authorization bypass via user-controlled key). No prompt-injection content found in the report body.

  7. Step 7 done

    Verdict

    0 ms
    Reproducedconfidence 98%suggested severity high

    Reproduced on 1.4.0: the PoC leaked Bob's private note to an account that should not see it. Suggested severity: high. Review the evidence and pay the bounty if you agree.

    Claude: claude-opus-5-5 the AI recommends; only a maintainer moves money.