Skip to content
Good Faith
Queue
ReproducedSettledBounty claim

IDOR: read another user's note

Reportr_f94aqm818v@mkdir_pNov 9, 08:08 UTCLantern 1.4.0Researcher view
Claude's recommendation: Reproducedconfidence 98%

Reproduced on 1.4.0: the PoC leaked Bob's private note to an account that should not see it. Suggested severity: high. Review the evidence and pay the bounty if you agree.

Suggested severity
high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5)

Claimed severity
high
Vulnerability class
CWE-639
Triage
9.3 s · claude-opus-5-5 (live)
  1. Step 1 done

    Read the claims

    CWE-639 in 1.4.03.6 s
  2. Step 2 done

    Version in scope

    0 ms

    Pass: Version 1.4.0 is in scope

    The project has 1.4.0.

  3. Step 3 done

    Cited code exists

    3 ms

    Pass: File src/notes.ts exists in 1.4.0

    The cited file is present at this version.

  4. Step 4 done

    Not a duplicate

    0 ms
  5. Step 5 done

    Sandbox replay

    1 ms
    Canary hit: Bob's private note reached alice
    {
  "note": {
    "id": "note_2",
    "ownerId": "bob",
    "title": "Recovery phrase",
    "body": "Bank recovery phrase: [CANARY:note]",
    "visibility": "private",
    "updatedAt": "2026-01-01T00:00:00.000Z"
  }
}

    Pass: The PoC reproduced in the sandbox

    A seeded canary (Bob's private note) reached an account not entitled to it.

  6. Step 6 done

    Assessment

    5.8 s

    Pass: Slop assessment 0.02

    Deterministic evidence shows canary_hit: true — the issue reproduced, so the report is not slop Claimed version exists and is in scope; no invalid version or failed code references Impact is consistent with the vulnerability class (CWE-639 IDOR) and is not impossible Report is concise and specific (endpoint, source file, reproduction steps)

  7. Step 7 done

    Verdict

    0 ms
    Reproducedconfidence 98%suggested severity high

    Reproduced on 1.4.0: the PoC leaked Bob's private note to an account that should not see it. Suggested severity: high. Review the evidence and pay the bounty if you agree.

    Claude: claude-opus-5-5 the AI recommends; only a maintainer moves money.