The $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PII

Severity: HighBounty: ~$949Program: Private Bug BountyPlatform: Bugbounty.sa This finding started with a very simple endpoint: GET /api/tickets-management/portal/history-by-ticket/<ticket_id> The end