Attachment disclosure via summary report

Hackerone provides a form for reporting vulnerabilities to various programs. where the form supports uploading files & previews (images or videos) but is not allowed to use file ids belonging to other accounts. but with the sumary report feature I as a hacker can reveal files belonging to other …

### Steps To Reproduce
If you look at the video I attached, there I made the scenario "failed to read other account files" & "successfully read other account files" as for the steps as follows:
note : left victim right attacker

1. the attacker creates a report either draft or existing, then …