connect.8×8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users//invites

Posted on February 16, 2023by bugbounty

8×8 Bounty disclosed a bug submitted by emperor: https://hackerone.com/reports/1474536 – Bounty: $777