Privilege Escalation to Scout Birthdate and Home Address

Archive Internet Advancement
,
1
  1. Create calendar entry that requires permission slip.
  2. Invite all the scouts in the unit
  3. Access the calendar entry through advancements.scouting.org as a den leader
  4. Click “Download permission slip”
  5. Look at pre-filled information for each scout (birthdate and home address)

Step 3 may not require den leader access.

2

Are you saying the DOB and address info is blank for you?

3

@tj.rothwell

How are you even testing this?

You created an event with a permission slip (using a role high enough to be able to create the event). You access IA as a Den Leader and click “Download Permission slip”. As a Den Leader, I don’t even see the option for permission slips in IA.

If you are talking about permissions slips in Scoutbook the only role high enough to download permissions slips, is a role high enough to create the event and access that information in the first place.