Summary
An authenticated user can replace the export identifier in a download request and retrieve a CSV generated by a second researcher-owned test account. The response returns 200 and includes that controlled account’s email address.
Steps to Reproduce
- 01Create one export from each of two researcher-owned test accounts.
- 02Copy Account A’s authenticated download request.
- 03Replace only the export identifier with Account B’s identifier.
- 04Send the request and observe Account B’s controlled record in the response.
Impact
A user can access a private record belonging to another account without authorization.