Skip to content
Good Faith
Bounty claimSettledReproduced

IDOR: read another user's note

Reportr_f94aqm818vby @mkdir_pNov 9, 08:08 UTCLantern 1.4.0claimed high
Triage
Finished in 9.3 s.
  1. Step 1 done

    Read the claims

    CWE-639 in 1.4.03.6 s
  2. Step 2 done

    Version in scope

    0 ms

    Pass: Version 1.4.0 is in scope

    The project has 1.4.0.

  3. Step 3 done

    Cited code exists

    3 ms

    Pass: File src/notes.ts exists in 1.4.0

    The cited file is present at this version.

  4. Step 4 done

    Not a duplicate

    0 ms
  5. Step 5 done

    Sandbox replay

    1 ms
    Canary hit: Bob's private note reached alice
    {
  "note": {
    "id": "note_2",
    "ownerId": "bob",
    "title": "Recovery phrase",
    "body": "Bank recovery phrase: [CANARY:note]",
    "visibility": "private",
    "updatedAt": "2026-01-01T00:00:00.000Z"
  }
}

    Pass: The PoC reproduced in the sandbox

    A seeded canary (Bob's private note) reached an account not entitled to it.

  6. Step 6 done

    Assessment

    5.8 s

    Pass: Slop assessment 0.02

    Deterministic evidence shows canary_hit: true — the issue reproduced, so the report is not slop Claimed version exists and is in scope; no invalid version or failed code references Impact is consistent with the vulnerability class (CWE-639 IDOR) and is not impossible Report is concise and specific (endpoint, source file, reproduction steps)

  7. Step 7 done

    Verdict

    0 ms
    Reproducedconfidence 98%suggested severity high

    Good news: we reproduced your report against a sandboxed instance (suggested severity high). A maintainer will review and release the bounty.

    Claude: claude-opus-5-5 the AI recommends; only a maintainer moves money.

Your report
Shown exactly as submitted. Triage reads it as untrusted data.

Description

GET /api/notes/:id in src/notes.ts returns the note to any authenticated user without checking ownership (CWE-639). Log in as alice and request bob's note note_2.

Structured PoC

  1. 1.GET/api/notes/note_2as alice