GetGlobalAchievementPercentagesForApp is missing the same release checks as GetSchemaForGame
Medium
V
Valve
Submitted None
Actions:
Reported by
xpaw
Vulnerability Details
Technical details and impact analysis
`GetGlobalAchievementPercentagesForApp` API method can be used to reveal achievement names/percentages for games that have not been released yet.
This is not a problem with `GetSchemaForGame` method, which leads me to believe the other method is missing all the relevant checks.
https://api.steampowered.com/ISteamUserStats/GetGlobalAchievementPercentagesForApp/v2/?gameid=██████
https://api.steampowered.com/ISteamUserStats/GetSchemaForGame/v1/?appid=████
`GetGlobalAchievementPercentagesForApp` should have the same release state checks as `GetSchemaForGame` as to not leak achievement names.
## Impact
This can be used to reveal and leak work-in-progress achievements for games that have not been released yet.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Information Disclosure