BugCrowd Bug Bounty Disclosure: P3 – NASA-User Owned PDF Publicly Exposed with Full Edit Rights — Risk of Deletion and PII Disclosure –

June 24, 2025
NASA-User Owned PDF Publicly Exposed with Full Edit Rights — Risk of Deletion and PII Disclosure

NASA-User Owned PDF Publicly Exposed with Full Edit Rights — Risk of Deletion and PII Disclosure

Researcher:
Engagement: National Aeronautics and Space Administration (NASA) – Vulnerability Disclosure Program
Disclosed at: 2025-06-16T16:25:55Z
Priority: P3
Status: Resolved

Summary

A NASA-owned PDF was publicly accessible with full edit rights, allowing anyone with the link to modify collaborators, delete the file, or view personal info. Similar files with editor access were also found, reported, and validated.

✍️ I’ll be dropping a write-up for this at: okBoss-Medium_Profile ⏳ Waiting for disclosure — if you’re seeing this, the write-up is live. Check it out!

Activity Feed

Actor Details Timestamp (UTC)
okBoss okBoss sent a: message 2025-06-23T16:53:19Z
Ron_Rose Ron_Rose marked the response request as resolved 2025-06-16T17:08:36Z
Ron_Rose Ron_Rose sent a: message 2025-06-16T17:08:35Z
Martin_NASA Martin_NASA published 2025-06-16T16:25:55Z
okBoss okBoss submitted a response request from 2025-06-16T14:12:32Z
okBoss okBoss sent a: message 2025-06-16T14:10:27Z
lemonade-bugcrowd lemonade-bugcrowd marked the response request as resolved 2025-06-16T14:05:26Z
lemonade-bugcrowd lemonade-bugcrowd sent a: message 2025-06-16T14:05:26Z
okBoss okBoss submitted a response request from 2025-06-16T13:45:30Z
okBoss okBoss updated 2025-06-15T09:14:51Z
okBoss okBoss requested 2025-06-15T09:12:14Z
okBoss okBoss sent a: message 2025-06-13T17:47:31Z
okBoss okBoss sent a: message 2025-06-12T15:07:38Z
Parker_Bugcrowd Parker_Bugcrowd changed the state to to resolved 2025-06-12T14:49:45Z
okBoss okBoss sent a: message 2025-06-11T16:04:56Z
ZachFahoury ZachFahoury sent a: message 2025-06-11T15:25:14Z
Martin_NASA Martin_NASA changed the state to to unresolved 2025-06-11T13:45:56Z
viper-bugcrowd viper-bugcrowd changed the state to to triaged 2025-06-11T13:06:23Z
viper-bugcrowd viper-bugcrowd changed the severity to 2025-06-11T13:06:21Z
viper-bugcrowd viper-bugcrowd sent a: message 2025-06-11T13:06:17Z
viper-bugcrowd viper-bugcrowd resolved a blocker for 2025-06-11T13:06:08Z
Ron_Rose Ron_Rose created a blocker on 2025-06-10T13:39:34Z
Ron_Rose Ron_Rose resolved a blocker for 2025-06-10T13:39:33Z
okBoss okBoss sent a: message 2025-06-09T14:43:56Z
okBoss okBoss sent a: message 2025-06-06T18:44:00Z
okBoss okBoss sent a: message 2025-06-05T12:06:18Z
okBoss okBoss sent a: message 2025-05-30T13:05:10Z
okBoss okBoss sent a: message 2025-05-28T03:33:10Z
okBoss okBoss sent a: message 2025-05-27T21:49:56Z
viper-bugcrowd viper-bugcrowd sent a: message 2025-05-26T15:22:00Z
viper-bugcrowd viper-bugcrowd created a blocker on 2025-05-26T15:21:53Z
okBoss okBoss created the submission 2025-05-25T19:43:36Z

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

Buy Me A Coffee
Patreon

To keep up to date follow us on the below channels.

Tags: , ,

You may have missed

image

[LYNX] – Ransomware Victim: Inflite Engineering Services

June 24, 2025
image

[SARCOMA] – Ransomware Victim: Machu Picchu Foods

June 24, 2025
image

[WORLDLEAKS] – Ransomware Victim: Myrtue Medical Center Hospital

June 24, 2025
image

CVE Alert: CVE-2025-6511

June 24, 2025
image

CVE Alert: CVE-2025-6510

June 24, 2025