WS-2022-0458

Liberapay was discovered to contain Email Address Exposure via Gratipay Migration Tool. Through the /migrate route, an attacker can input the username of any user on the site and retrieve their primary email address without any authorization required. The issue is resolved in 675...

Liberapay: Email Address Exposure via Gratipay Migration Tool

Through the /migrate route, an attacker can input the username of any user on the site and retrieve their primary email address without any authorization required. Steps to reproduce: Note: This cannot be performed with hackerone-target, because that account seems to return a None as an email. 1...