Bounty claimSettledDuplicate

Able to view notes owned by other accounts

Reportr_64dhf4act2by @late_to_the_partyNov 9, 07:58 UTCLantern 1.4.0

Triage

Finished in 12 s.

Step 1 done
Read the claims
CWE-639 in 1.4.03.4 s
Step 2 done
Version in scope
0 ms
Pass: Version 1.4.0 is in scope
The project has 1.4.0.
Step 3 done
Cited code exists
1 ms
Pass: File src/notes.ts exists in 1.4.0
The cited file is present at this version.
Step 4 done
Not a duplicate
2.3 s
Duplicate: Duplicate of r_6y9btspn6v
Similarity 0.93; same class and component: true.
Step 5 done
Sandbox replay
0 ms
Inconclusive: Skipped replay (duplicate)
Treated as a duplicate of r_6y9btspn6v; not replayed so the bounty is not paid twice.
Step 6 done
Assessment
5.9 s
Assessment: Slop assessment 0.20
Version exists and is in scope; no fabricated version or code reference detected Code reference (src/notes.ts, GET /api/notes/:id) did not fail validation Impact is plausible and consistent with the CWE-639 IDOR class Report is terse with no reproduction steps, request/response samples or PoC, so it is unverified rather than fabricated Canary did not reproduce; this alone does not indicate slop
Step 7 done
Verdict
0 ms
Duplicateconfidence 93%suggested severity medium
Thanks for the report. It appears to match an earlier accepted report, so it is likely a duplicate. Your deposit will be released.
Claude: claude-opus-5-5 the AI recommends; only a maintainer moves money.

Your report

Shown exactly as submitted. Triage reads it as untrusted data.

Reading other users' notes is possible: GET /api/notes/:id in src/notes.ts does not verify the owner (CWE-639 IDOR).