Improper Privilege Management in circuitverse/circuitverse
Aug 24th 2021
subscribe to any private project
🕵️♂️ Proof of Concept
There is two different user called user-A and user-B.
1. User-A created a private project .
2. Now User-B sent bellow request to subscribe to above private project
here in this request just change the project id with above project and forward the request. After that user-B will subscribed to this private project .
3. Now any user make comment to this private project then user-B will receive email notification.
So,using this bug any user can subscribe to any private project and receive email notification if anyone comment in this private project