I'm interested in testing the security of 'Unsubscribe' links embedded in emails sent to customers by large companies. I'm targeting companies participating in a certain bug bounty program, and my question is about scope:

If I think I've discovered a pattern in the generated unsubscribe links (the token in the url is being incremented, for example), I'll want to test that by navigating to a URL that, if successful, will unsubscribe some other user from company emails. Does this qualify as a breach of customer experience or data?

  • 3
    "customer experience" problems are not really what we deal with here and whether or not they are in scope of your bug bounty program is up to the program. – schroeder Jan 25 at 19:41

Yes, unsubscribing customers unwillingly is a security finding. It's hard to say how much that finding is "worth." Have you joined or read up on bug crowd or other centralized bug hunting and bounty programs? This kind of thing tends to go better if you are part of a "syndicate" instead of disclosing alone.

  • Under what aspect of security is this a finding? – schroeder Jan 25 at 19:42
  • Sorry, my question was unclear. I meant to ask whether unsubscribing a customer from email notifications in the course of testing would be considered a violation of scope, not whether the finding had merit. As @schroeder pointed out, I guess this comes down to the particulars of each organization's bounty contract. I'm very new, and I guess I was generally curious about how organizations handle cases of 'incidental damage' (however slight), like the one I described. – jandek Jan 25 at 19:47
  • 2
    @mr_pb you need to raise the question with the bounty organiser – schroeder Jan 25 at 19:51
  • @schroeder are you saying it's not or are you asking me to add that to this response? The ability to manipulate a web url for malicious intent is a application layer security (web) vulnerability and falls right inline with coupon hacking that's so prevalent (skimming coupons with badly designed api's with ++1 counters). – bashCypher Jan 25 at 20:48
  • 2
    we talk about the CIA triad don't we? Confidentiality, Integrity and Availability. If you can unsubscribe other users, I would call it a breach of Availability. – mcgyver5 Jan 25 at 21:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.