Hacktivity
Every decision, on the record.
Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.
Disclosed
1
Paid in this view
$665k
Filtered by program:ledgerline ×
- highPGN-10387
Mass assignment on team invite sets owner role via nested attributes
The invite endpoint blocked role_id at the top level but accepted it under attributes.membership.
Ledgerline@hex_tideImproperly Controlled Modification of Dynamically-Determined Object Attributes28 Sept 2026triage 6.4hresolved 5.3d$9,500Resolved
Hacktivity
Connecting- Mass assignment on team invite sets owner role via nested attributeshigh$9,500