Privilege Escalation to Scout Birthdate and Home Address

  1. Create calendar entry that requires permission slip.
  2. Invite all the scouts in the unit
  3. Access the calendar entry through as a den leader
  4. Click “Download permission slip”
  5. Look at pre-filled information for each scout (birthdate and home address)

Step 3 may not require den leader access.

Are you saying the DOB and address info is blank for you?


How are you even testing this?

You created an event with a permission slip (using a role high enough to be able to create the event). You access IA as a Den Leader and click “Download Permission slip”. As a Den Leader, I don’t even see the option for permission slips in IA.

If you are talking about permissions slips in Scoutbook the only role high enough to download permissions slips, is a role high enough to create the event and access that information in the first place.