Skip to content
Good Faith
Bounty claimSettledReproduced

IDOR: read another user's note

Reportr_6y9btspn6vby @mkdir_pNov 9, 07:58 UTCLantern 1.4.0claimed high
Triage
Finished in 9.9 s.
  1. Step 1 done

    Read the claims

    CWE-639 in 1.4.04.2 s
  2. Step 2 done

    Version in scope

    0 ms

    Pass: Version 1.4.0 is in scope

    The project has 1.4.0.

  3. Step 3 done

    Cited code exists

    4 ms

    Pass: File src/notes.ts exists in 1.4.0

    The cited file is present at this version.

  4. Step 4 done

    Not a duplicate

    0 ms
  5. Step 5 done

    Sandbox replay

    2 ms
    Canary hit: Bob's private note reached alice
    {
  "note": {
    "id": "note_2",
    "ownerId": "bob",
    "title": "Recovery phrase",
    "body": "Bank recovery phrase: [CANARY:note]",
    "visibility": "private",
    "updatedAt": "2026-01-01T00:00:00.000Z"
  }
}

    Pass: The PoC reproduced in the sandbox

    A seeded canary (Bob's private note) reached an account not entitled to it.

  6. Step 6 done

    Assessment

    5.7 s

    Pass: Slop assessment 0.02

    Canary reproduced (canary_hit: true): the IDOR was confirmed, so the report is not slop. Claimed version exists and is in scope, and the code reference resolved without failure. Impact is plausible and matches the vulnerability class (CWE-639, authorization bypass via user-controlled key). No prompt-injection content found in the report body.

  7. Step 7 done

    Verdict

    0 ms
    Reproducedconfidence 98%suggested severity high

    Good news: we reproduced your report against a sandboxed instance (suggested severity high). A maintainer will review and release the bounty.

    Claude: claude-opus-5-5 the AI recommends; only a maintainer moves money.

Your report
Shown exactly as submitted. Triage reads it as untrusted data.

GET /api/notes/:id in src/notes.ts returns the note to any authenticated user without checking ownership (CWE-639). Log in as alice and request bob's note note_2.

Structured PoC

  1. 1.GET/api/notes/note_2as alice