Wielton (wielton.com.pl) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

Wielton is a top-three European trailer group operating a heavily integrated digital estate — public product catalogues, authenticated dealer-portal backends, B2B configurators with pricing logic, fleet-management dashboards, CRM pipelines holding customer PII and order histories, spare-parts e-commerce modules, 3D trailer visualisation engines, and logistics/supply-chain API bridges into subsidiary ERPs — fertile ground for broken access control, cross-dealer data leaks, and configurator-bypass or pricing-manipulation chains if any boundary slips. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

In scope materially: every HTTP(S) origin answering for wielton.com.pl and delegated subdomains, dealer-authentication portals, product-configurator engines and their REST/GraphQL backends, fleet-telemetry dashboards, CRM customer-data stores, spare-parts catalogue APIs, 3D visualisation endpoints, and any subsidiary-localised mirrors Wielton operates or configures.
Civil exclusions only: mass harassment, ransomware against unrelated third parties, laundering. Not product carve-outs.

There is exactly one bounty amount that maps to payouts on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows must exhibit (a) attacker-readable kill-chain storytelling and (b) objective proofs of successful exploitation replayable by Wielton responders (Burp transcripts, scripted API sequences, SSRF egress captures, configurator-bypass traces, dealer-data-exfiltration proofs…).

These rows do not impose limits — shorthand for tagging reports. Anything Wielton hosts, signs, proxies, caches, orchestrates, or webhook-delivers counts as bounty ground even if undocumented here. Treat "not listed" ≠ "out-of-scope": default stance is open scope across Wielton.

This playbook refuses "only these SKU endpoints." Dealer-portal sub-tenants, configurator staging mirrors, fleet-telemetry boards, CRM pipelines, subsidiary-localised storefronts, 3D-model delivery CDNs — all bounty eligible when critical impact is reproducible.

• Every apex / vanity hostname routing through Wielton edge — claim routing evidence in your chain write-up.
• Dealer-authentication portals and role-based dashboards Wielton ships toward its dealer network
• Configurator engines and pricing-rule backends that feed B2B quotations
• Supply-chain or ERP API bridges Wielton operates across international subsidiaries

1. Prove exploitation success. Ship artefacts third parties rerun: scripted curl flows, Burp/HAR exports, SSRF egress captures, configurator-bypass scripts with verified pricing-state mutation.
2. Articulate kill chain granularity. Number each hop: auth boundary → abused endpoint → escalation → monetizable damage (dealer ATO, cross-subsidiary bleed, configurator fraud, fleet-data exfil, infra takeover…).
3. Responsible blast radius documentation. Quantify dealers, subsidiaries, or customers affected even when exercised only on staging mirrors that mirror routing + auth faithfully.
4. Encrypt & ship privately. Use sanctioned intake on wielton.com.pl (see submit section) before broadcasting exploit details.
5. Honor duplicate fairness. First fully qualifying chain + reproducible exploitation wins treasury on collisions.

Start from the security / disclosure contact publicly listed on wielton.com.pl (security@wielton.com.pl is a common pattern — verify on the vendor site before sending). Mandatory sections mirror below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — impact in one paragraph

# Severity self-classification → must map to Wielton critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session / dealer context / API key scope)
2. Entry primitive — exact HTTP verb/path/query/body
3. Pivot(s) chaining trust escalation
4. Final hop → dealer ATO / cross-subsidiary damage / configurator fraud / fleet-data exfil equivalent

## Successful exploitation evidence
• Replayable script + truncated responses showing impact
• HAR / Burp with unauthorized state change
• Configurator-pricing or dealer-data logs proving forged operation accepted

## Reproduction package
Commands + fixtures + pinned SHAs

## Disclosure ack
Responsible channel only until Wielton clears publication coordination

Pseudocode for dealer-portal role checks skipped on direct API access — useless without traces proving unauthenticated wielton.com.pl calls mutate protected dealer or fleet state.

// BUGGY: dealer-role guard skipped when called via internal API bridge
function resolveDealerContext($request) {
    $dealerId = $request->header('X-Wielton-Dealer-Id');
    if ($request->isInternalBridge()) {
        // bridge calls skip role enforcement entirely
        return Dealer::withFullAdminScope($dealerId);
    }
    return Dealer::withVerifiedRole($dealerId);
}