Overview
Validating a finding includes establishing its impact — what it actually allows — which determines its severity and value. This lesson covers impact in validation.
Learning objectives
- Explain establishing a finding's impact.
- Describe assessing impact safely and accurately.
- Connect impact to severity and value.
Core concept
Impact is what a vulnerability actually allows an attacker to do — the consequence — framed via the CIA triad (confidentiality/integrity/availability) plus outcomes like account takeover or privilege escalation (from the fundamentals and exploitation-concepts modules). Establishing impact is part of validation: a finding's value and severity depend on its real, demonstrated impact. In bug bounty, impact is assessed safely and accurately — grounded in what the (safe, minimal) demonstration actually shows, not exaggerated, and without causing harm or accessing real sensitive data to "prove" a bigger impact.
How it works
Having reproduced the finding, the researcher determines its impact: what does the access/flaw actually allow (read others' data? modify records? take over an account? escalate privilege?), and how significant is that (data sensitivity, scope of affected users/assets)? This is assessed from the safe demonstration — proving the impact minimally without exfiltrating real data or causing harm (proving controllability/reach is enough). The impact must be accurate (grounded in what was shown, not speculative or exaggerated) since it drives severity and the program's reward. Overstating impact undermines credibility; understating it undersells a valid finding. Accurate, safe impact assessment produces a credible, appropriately-valued finding.
Practical example
The researcher has reproduced a BOLA finding (test user A accessing test user B's records). Establishing impact, they determine it allows any user to read other users' records — a significant confidentiality impact affecting all users — demonstrated safely with their own test accounts (not by accessing real users' data). They frame the impact accurately (mass access to others' data) to convey severity, without exaggerating or exfiltrating real data. This accurate, safe impact assessment establishes the finding's value for the report.
Cybersecurity relevance
Establishing impact accurately and safely is central to a finding's severity and reward: severity is impact (× likelihood), and bug bounty rewards scale with demonstrated impact. Grounding impact in a safe demonstration (not exfiltrating real data or causing harm) is both responsible (per program rules and "do no harm") and sufficient — echoing the exploitation-concepts safe-impact discipline. Accurate impact (neither exaggerated nor understated) maintains credibility and appropriate valuation. It connects reproduction to severity and reporting. Safe, accurate impact assessment is a key validation and reporting skill.
Common mistakes
- Exaggerating impact beyond the safe demonstration (undermines credibility).
- Accessing real sensitive data to "prove" bigger impact (harmful, prohibited, unnecessary).
- Understating impact, underselling a valid finding's severity.
Key takeaways
- Impact is what a vulnerability allows (framed via CIA plus takeover/escalation); it determines severity and reward.
- Establish impact from the safe, minimal demonstration — accurately (not exaggerated or understated) and without exfiltrating real data or causing harm.
- Accurate, safe impact assessment maintains credibility and appropriate valuation, connecting reproduction to severity and reporting.
Check your understanding
- Why does a finding's impact determine its severity and reward?
- Why must impact be established safely (without exfiltrating real data) and accurately?