300$ ETag Bounty

I was participating a new private program at h1 and I was desperately discovering site to see anything unusual. As all expert says "do not just change number to find IDOR" but I always change anything to see server reaction. Since I just logged in I started testing basic functions such as creating new product. Once you watch Burpsuite history 5 hours a day you become an expert of auto-filter and I realize some endpoint ending with /validate and its very common path but sometimes developers forget to implement security checks.

(FREE LINK)

Steps To reproduce

1- Send PUT request to create new product

PUT /create/product/{product_id}/validate

PUT /create/product/{product_id}/validate

2- Once product created modify product and observe that server send request without validate. Try to change productId with victim productId and add /validate to end of endpoint

PUT /create/product/{victim_product_id}/validate

PUT /create/product/{victim_product_id}/validate

3- Server response is weird. ( Maybe you saw same error but just ignored because it make no sense :)

And the Error :

Server send ETag header with PUT request and if ETag header value does not match with latest "productId" request response ETag, server response with this error.

4- Change ETag value according to server error and send request again

It worked. I wasnt expecting it at all. But itworked. ( I tried to modify victim data etc. but didn't worked i still feel like I could find a way …)

IMPACT

Attacker can access every draft product metadata including ownerId and product details .

Timeline

July 6, 2026 — Bug Reported July 7, 2026 — Triaged and 300$ bounty awarded Agust 12, 2026 — Bug Resolved