Uber: Missing authentication on Notification setting .

2016-05-03T05:22:31
ID H1:135891
Type hackerone
Reporter vijay_kumar
Modified 2016-07-26T00:37:14

Description

Hi , Notification setting link works without cookies so an attacker can steal link from browser histroy and can change notification setting of victim. Notification setting link does not expire even after logout.

Steps to reproduce :- 1.Log in as uber rider. 2.Go to profile. 3.Now go to "Manage your email subscription settings". 4.Copy link of this page and open this link in another browser , it works perfectly. 5.It also works after logout.