Press enter or click to view image in full size
How a simple authorization flaw in a popular email marketing platform could have exposed sensitive campaign data across thousands of organizations
📋 Quick Facts
- Target: Stripo Inc (Email Design Platform)
- Vulnerability: Unauthorized Cross-Tenant Data Access
- Severity: Critical
- CWE: CWE-284: Improper Access Control
- Status: Resolved ✅
- Platform: HackerOne
- Bounty: Not Disclosed
- Feature Affected: AI Hub Campaign
🎖️ Researcher Attribution
This critical vulnerability was discovered and responsibly disclosed by No Code (@srcode) through HackerOne’s bug bounty program. Their diligent research helped protect potentially millions of users across Stripo’s customer base. Full credit goes to the original researcher for identifying this significant security flaw.
📖 The Story: When AI Features Meet Authorization Failures
Stripo has become a household name in the email marketing world. Used by over 1 million users globally, the platform allows…