---
title: "Discussion on \"The $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PII\" | Hashnode"
description: "Discussion on \"The $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PII\". Severity: HighBounty: ~$949Program: Private Bug BountyPlatform: Bugbounty.sa\nThis finding started with a very simple endpoint:\nGET /api/tickets-management/portal/history-by-ticket/<ticket_id>\n\nThe end"
url: "https://hashnode.com/posts/the-1000-ticket-idor-one-number-exposed-national-ids-and-government-staff-pii/6a84981a420d939a0d95077d"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [The $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PII](https://blog.abdulaziz-d.com/the-1000-ticket-idor-one-number-exposed-national-ids-and-government-staff-pii?utm_source=hashnode&utm_medium=feed)

Severity: HighBounty: ~$949Program: Private Bug BountyPlatform: Bugbounty.sa This finding started with a very simple endpoint: GET /api/tickets-management/portal/history-by-ticket/<ticket\_id> The end

Aug 18 · 10 min read · blog.abdulaziz-d.com  
Read the article

-   [#bugbounty](https://hashnode.com/tag/bugbounty)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#hacking](https://hashnode.com/tag/hacking)
-   [#writeup](https://hashnode.com/tag/writeup)

## Written by

[Abdulaziz Saad](https://hashnode.com/@b4zb0z)

@b4zb0z · Jeddah, SA

  
[View profile](https://hashnode.com/@b4zb0z)

INTJ | Self-made | Web Developer | Rusty Hacker

## Responses

Markdown supported · ⌘↵ to post

No responses yet.