Authorization / Broken Access Control
Authorization vulnerabilities occur when applications fail to properly enforce access controls, allowing users to perform actions or access resources beyond their intended permissions. Broken Access Control consistently ranks as the #1 risk in the OWASP Top 10, encompassing issues like privilege escalation (both vertical and horizontal), missing function-level access controls, and insecure direct object references at the authorization layer. Unlike authentication (verifying who you are), authorization determines what you are allowed to do — and flaws here can expose entire administrative interfaces, allow users to modify other accounts, or grant elevated privileges through parameter tampering, forced browsing, or JWT manipulation. Modern applications with complex role hierarchies, microservice architectures, and API-first designs face particular challenges in maintaining consistent authorization checks across every endpoint and resource.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-09-18 NEW 2026 | The skb that wasn't freed - the Fragnesia primitive via Open vSwitch advanced RCE | A deterministic local privilege escalation vulnerability, dubbed "Fragnesia," affects default installations of Arch, Fedora, Debian, Amazon Linux, and RHEL when user namespaces are enabled and Open vSwitch is auto-loading, despite the kernel carrying the fix. The issue was publicly disclosed on August 13, 2026, and a patch was integrated into the mainline and stable kernel by September 4, 2026. This exploit arises from a scenario where a "skb" (socket buffer) is not freed. No bug bounty payout amount is mentioned in the provided text. → blog.doyensec.com |
| 2026-09-15 NEW 2026 | Ask the Agent Nicely: Two Authorization Bypasses in n8n AI Agents intermediate 8 min read AI | Writeup on CVE-2026-65015 and CVE-2026-59207 detailing two authorization bypasses in n8n AI Agents. The first, CVE-2026-65015, allows a read-only Project Viewer to execute arbitrary n8n nodes, including exfiltrating credentials and potentially executing host commands. The second, CVE-2026-59207, bypasses the "Allowed HTTP Request Domains" restriction for credentials via the MCP client, enabling credential exfiltration. |
| 2026-09-15 NEW 2026 | Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection advanced 13 min read | Library for mapping cloud identities by extracting activity patterns from audit logs using a behavioral clustering model. This model employs unsupervised machine learning algorithms, specifically UMAP and HDBSCAN, to categorize cloud identities into functional roles like administrators, backup services, and DevOps. The approach analyzes invoked operations within AWS CloudTrail data and can be extended to other cloud environments. The library extracts lightweight heuristic logic for SQL implementation, enabling scalable, continuous operational visibility without resource-intensive machine learning pipelines. → unit42.paloaltonetworks.com |
| 2026-09-12 NEW 2026 | Uncontrolled Access Control: Compromising Paxton10 intermediate 6 min read | Writeup detailing a chain of vulnerabilities in the Paxton10 access control system that enables unauthenticated, network-adjacent attackers to achieve operating system command execution. The exploitation involves leveraging hardcoded credentials for the nginx diagnostic portal, extracting plaintext bearer tokens from access logs, and exploiting an SQL injection vulnerability in the lost tokens event search. This SQL injection leads to command execution via `xp_cmdshell`, which is unconditionally enabled and accessible due to the sysadmin role granted to service accounts. |
| 2026-09-11 NEW 2026 | Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability news Mobile | OnePlus's preinstalled OEM app has a session takeover vulnerability that remains unresolved after nine months. While technical details were temporarily removed at the vendor's request, a limited window for remediation has reopened. The security firm involved emphasizes responsible disclosure and is urging OnePlus to address the issue. No bounty payout amount is mentioned. → blog.doyensec.com |
| 2026-09-11 NEW 2026 | The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE advanced 11 min read | Tool for exploiting SPIFFE/SPIRE identity misuse by spoofing Linux cgroup information on compromised Kubernetes nodes. This research details how an attacker with root access can impersonate co-located workloads and harvest SPIFFE Verifiable Identity Documents (SVIDs) by tricking the SPIRE agent during attestation. The tool, named Spooffe, assists defenders in assessing the impact of such attacks. Recommendations include hardening nodes, restricting root access, prohibiting privileged containers, and minimizing reliance on weak selectors. → unit42.paloaltonetworks.com |
| 2026-09-11 NEW 2026 | Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490 news 12 min read RCE | Library for detecting and weaponizing NetScaler CVE-2026-19490, an authentication bypass in SAML handling. The library includes a detection tool that uses a single, safe request to determine if an appliance is patchable and maps configuration forks from a safe pre-authentication check to potential root command execution. It details the vulnerability’s bypass mechanism, prerequisite SAML configurations, and the impact of anonymous sessions. → bishopfox.com |
| 2026-09-10 2026 | Fortinet Privileged Access Agent: Any Site Could Control Your Proxy and Watch Your Tab news 2 min read RCE | Writeup of CVE-2026-84388 in Fortinet Privileged Access Management Chrome extension. This vulnerability, with a CVSS of 9.1, allowed any website to control the user's browser proxy and initiate screen recordings of newly opened tabs. Attackers could exploit this by tricking users into visiting a malicious site, which would then become a trusted server for the extension, enabling phishing attacks and data exfiltration, particularly of sensitive information displayed in the attacker-controlled tab. Fortinet released a fix within two weeks of disclosure. |
| 2026-09-10 2026 | Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise news 12 min read AI RCE | Library for identifying and exploiting vulnerabilities in LiteLLM, a popular open-source LLM gateway. It details authentication bypass flaws, including CVE-2026-59822 which allows unauthenticated access to MCP endpoints and can lead to root-level remote code execution and cloud credential theft. The writeup also covers scenarios with default master keys, unauthenticated admin access, and post-authentication cloud credential theft vectors due to missing URL validation in pass-through endpoints. → wiz.io |
| 2026-09-09 2026 | BOLA: Enumerating an Entire Employee Directory Through a Predictable ID intermediate IDOR | During an authorized penetration test of the "TargetApp" SaaS platform, a cybersecurity engineer discovered a vulnerability allowing enumeration of the entire employee directory. The vulnerability stemmed from a predictable ID used in an internal HR/personnel endpoint. This allowed attackers to access and potentially extract sensitive employee information. The issue was reported to the client and has since been remediated and confirmed. No bug bounty payout amount was specified. → infosecwriteups.com |
| 2026-09-06 2026 | ExploitSpec — BOLA/IDOR regression tests from bounded, redacted HAR input intermediate 1 min read API Sec IDOR | Tool for creating regression tests from bounded, redacted HAR input to catch returned vulnerabilities like BOLA/IDOR. ExploitSpec allows engineers to keep exploit security invariants beside application code for local and CI reruns, supporting isolated headers, cookies, and HTTP sessions, and capturing dynamic values for later requests. It outputs readable text, JSON, or JUnit, requires explicit authorization and bound responses, and can convert cURL or HAR requests into starter specs. |
| 2026-09-05 2026 | Authorization terminology is a mess: Let's fix it beginner 14 min read | Library for clarifying authorization terminology, offering a six-axis classification system beyond common labels like RBAC, ABAC, and PBAC. It breaks down authorization into distinct stages: rule definition, rule format, data input, decision computation, and enforcement, mapping familiar terms to specific axes rather than entire systems. This approach aims to resolve confusion caused by decades of overlapping definitions across research, vendors, and standards bodies. |
| 2026-09-04 2026 | Signature Optional - Analysis of CVE-2026-28323 news 9 min read | Analysis of CVE-2026-28323 details an unauthenticated SAML authentication bypass in SolarWinds Web Help Desk, allowing attackers to forge SAML Responses and seize administrative control. The vulnerability, present in versions 2026.1 and earlier, stemmed from conditional signature verification and acceptance of unsigned assertions. Patching to WHD 2026.2.1, which replaced the legacy SAML stack with Spring Security's SAML2 library, provides adequate remediation by enforcing signature verification. Defenders are advised to patch immediately, disable SAML as a workaround, audit configurations for missing certificates, and check access logs for suspicious POST requests. → bishopfox.com |
| 2026-09-03 2026 | Rooted in Trust: Three privilege-escalation vulnerabilities in HP Easy Start for macOS (CVE-2026-12554, CVE-2026-12555, CVE-2026-12556) news | Three critical privilege-escalation vulnerabilities (CVE-2026-12554, CVE-2026-12555, CVE-2026-12556) have been discovered in HP Easy Start for macOS. These flaws, dubbed "Rooted in Trust," allow attackers with lower privileges to gain elevated access on affected systems. This could lead to unauthorized modifications or control over the macOS environment. Users are advised to update HP Easy Start to the latest version to mitigate these security risks. |
| 2026-09-03 2026 | The $8,000 Shortcut: Hijacking Microsoft Edge via NTFS Directory Junctions intermediate RCE | A researcher discovered an $8,000 vulnerability in Microsoft Edge that exploited NTFS directory junctions, a Windows filesystem feature. This allowed Edge to be tricked into executing arbitrary code as the user. The attack leveraged the "Confused Deputy" principle, where the browser, due to the junction, ended up following a path it shouldn't have. This allowed for a significant security bypass, earning the researcher an $8,000 bounty. → infosecwriteups.com |
| 2026-09-02 2026 | Hiding a Signup Button Isn’t Security: From Client-Side Controls to Cross-Tenant Data Exposure intermediate | The article highlights a critical security flaw: hiding a signup button doesn't equate to disabling signup functionality. The author discovered that a frontend JavaScript flag set to `USER_SIGNUP: false` was misleading. Despite the flag, the signup feature was still accessible, indicating that client-side controls are insufficient for robust security. This vulnerability could lead to unintended user registrations or, more significantly, potential cross-tenant data exposure. The author emphasizes that true security requires server-side validation, not just UI manipulation. No bounty payout amount was mentioned. → infosecwriteups.com |
| 2026-09-01 2026 | Privilege escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC endpoint advanced 2 min read | Technique detailing privilege escalation from IIS AppPool to NT Authority\SYSTEM within an Active Directory domain. This method leverages a Windows behavior where IIS AppPool identities accessing network resources are elevated to the host's machine account. The technique involves submitting a Certificate Signing Request to the Active Directory Certificate Services (AD CS) RPC endpoint, obtaining a machine account certificate, and then using the S4U2Self technique with tools like Rubeus to impersonate administrator accounts. |
| 2026-08-30 2026 | How I Got My Highest Payout intermediate Bug Bounty | The author details how they discovered a bug in an application portal that generated a comprehensive PDF of user and family data. The bug remained unfixed because the lengthy and tedious nature of the application form deterred most users and security researchers from completing it. This prolonged form-filling process, which took the author nearly an hour, was the key to the bug's longevity. The content does not mention a specific bounty payout amount. → infosecwriteups.com |
| 2026-08-27 2026 | A Blackstone real estate company exposed SSN digits, DOBs, addresses and more intermediate 4 min read | Writeup on a GraphQL data exposure vulnerability affecting Beam Living, a Blackstone real estate company, where PII including SSN digits, DOBs, and addresses were accessible via email. The vulnerability, identified while applying for a lease, allowed querying for sensitive applicant data by substituting a known email address into the GraphQL query. The author disclosed the issue, which was eventually patched after a delayed response from Beam Living. |
| 2026-08-27 2026 | Omarchy development practices lead to predictable security issues news 2 min read | Analysis of Omarchy reveals predictable security issues due to poor development practices, including bash injection vulnerabilities and insecure handling of untrusted input. The article criticizes the project's marketing for downplaying these fundamental security flaws, suggesting the team prioritizes iteration over system security, making Omarchy a risky choice for users concerned about machine security. |
| 2026-08-27 2026 | A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console intermediate 16 min read RCE | Tool for detecting RCE vulnerabilities (CVE-2026-58073, CVE-2026-58072) in Veeam Service Provider Console. The tool identifies unauthenticated remote code execution flaws stemming from an agent's GUID being treated as a credential and an arbitrary file write vulnerability. These issues, with CVSS scores of 9.5 and 9.0 respectively, allow attackers to impersonate agents, obtain their certificates, and execute arbitrary code on the management server. → bishopfox.com |
| 2026-08-26 2026 | Local Privilege Escalation To System In Wibu-Systems CodeMeter Application intermediate 8 min read | Library for privilege escalation targeting Wibu-Systems CodeMeter. This library details a method to achieve SYSTEM privileges from a low-privileged session by leveraging CodeMeter's `cmu.exe` to create files under `C:\CM-Stick`. Through a directory symlink hijack, this capability becomes an arbitrary file delete. Combined with the `::\$INDEX_ALLOCATION` NTFS trick and the Windows Installer's `C:\Config.Msi` rollback technique, it enables a full local privilege escalation to SYSTEM. |
| 2026-08-26 2026 | State divergence enables unauthorized access intermediate 5 min read IDOR | Writeup of a Provenance Blockchain vulnerability, CVE-2026-XXXX, allowing unauthorized admin control over marker accounts. The bug in versions before 1.28.0 stemmed from state divergence where an authorization check incorrectly read a stale supply field, enabling any user to grant themselves ACCESS_ADMIN permissions. Exploitation involved two transactions to mint new tokens or drain escrowed assets, impacting 82 markers representing live financial assets with potential losses exceeding $500,000 in nhash. Fixes were deployed in versions 1.28.0 and 1.29.0. → blog.trailofbits.com |
| 2026-08-25 2026 | Insight into agentic hacking tools: Hermes, OpenClaw and the Bayesian brain advanced 10 min read AI | Tool that analyzes the Hermes and OpenClaw agentic AI framework used in autonomous cyber operations against government entities in Asia. The framework employed Bayesian prioritization, autonomous research, and feedback loops to crack credentials, exfiltrate data, and achieve persistent backdoors in state infrastructure, bypassing traditional guardrails by framing activities as authorized penetration testing. |
| 2026-08-24 2026 | I Changed One “User_Id” and the API Said “Sure” — From Password Reset to Mass Account Takeover intermediate API Sec | A critical account takeover vulnerability was discovered in an API's password reset functionality. The flaw allowed attackers to change any user's password by simply altering a "user_id" parameter. This bypasses standard security checks, enabling mass account takeover. The vulnerability highlights the danger of the backend trusting client-provided data for sensitive operations like password resets. → infosecwriteups.com |
| 2026-08-21 2026 | [tl;dr sec] #342 - Figma's Agentic Detection, Agent Identity, Uber's Agent-(E)DR beginner 10 min read AI | Tool from Uber, ADR, provides production security for enterprise AI agents by pairing an observability sensor for telemetry with a two-tier detector. This system identifies unsafe behaviors such as credential exposure, prompt injection, data exfiltration, and policy-violating tool use, benchmarked across numerous agent attack techniques and MCP servers. → tldrsec.com |
| 2026-08-19 2026 | How to Spot and Stop Rogue Device Joins intermediate 5 min read Recon | Library for detecting and preventing rogue Entra ID device registration abuse. It details how attackers use AI to generate realistic device names and User-Agent strings to bypass traditional detection methods like static IOCs. The library emphasizes behavioral detection, focusing on naming convention anomalies and correlating device code phishing alerts with subsequent registrations, rather than relying on predictable tool fingerprints. It also suggests implementing MFA for device registration and restricting registrations to corporate IP addresses or compliant devices to mitigate risks. → wiz.io |
| 2026-08-18 2026 | Unauthenticated RCE in CircleCI's MCP server: Host/Origin allowlist bypassed by any non-browser client (GHSA-xv5j-cwgj-22r4) news 4 min read RCE | Writeup of GHSA-xv5j-cwgj-22r4 in CircleCI's MCP server details an unauthenticated RCE vulnerability. Attackers can bypass Host/Origin header validation by sending requests with `Host: localhost` and no Origin header, allowing them to execute arbitrary commands within the CI/CD pipeline using the organization's API token. The analysis highlights this as a critical security flaw, stressing the inherent risks in MCP architectures where ease of use often compromises robust authentication, leading to direct code execution capabilities. |
| 2026-08-18 2026 | They patched their SaaS and left the self-hosted OSS version vulnerable - AppFlowy Authenticated SQL Injection news 3 min read SQLi | Writeup on an authenticated SQL injection vulnerability in the self-hosted version of AppFlowy. Authenticated users can exploit the `search_term` parameter in the `/api/workspace/{workspace-id}/quick-note` endpoint to exfiltrate, modify, or delete database data. This vulnerability was not patched in the open-source, self-hosted version, despite being fixed in their commercial AppFlowy Cloud offering. |
| 2026-08-18 2026 | How an Unauthenticated API Endpoint Exposed 19,990 User Records news API Sec | An unauthenticated API endpoint on an AI-focused freelance marketplace exposed Personally Identifiable Information (PII) for 19,990 users due to a missing authorization check. The researcher discovered they could access and view other users' profile data by simply altering a URL parameter. This vulnerability highlights the critical security risk of trusting frontend requests without proper backend validation. The issue was responsibly reported and acknowledged. → infosecwriteups.com |
| 2026-08-17 2026 | Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform news 25 min read Secrets | Writeup detailing vulnerabilities found in points.com, the backend for major airline and hotel rewards programs. The research uncovered a directory traversal flaw granting access to 22 million order records containing sensitive customer data. Further authorization bypasses allowed attackers to transfer reward points and leak customer information using only rewards numbers and surnames. Leaked tenant credentials for the Virgin rewards program enabled API request signing on behalf of the airline, while a weak Flask session secret on the global administration website provided full super administrator permissions. → samcurry.net |
| 2026-08-17 2026 | Hacking Kia: Remotely Controlling Cars With Just a License Plate news 9 min read | Writeup detailing remote car control vulnerabilities in Kia vehicles, allowing attackers to manipulate functions solely with a license plate. The research identified flaws in the Kia Connect app and dealer portal, enabling unauthorized access to vehicle functions and personal data. The writeup highlights the exploitation of API endpoints and registration processes, demonstrating how an attacker could gain control by registering as a dealer and generating access tokens. → samcurry.net |
| 2026-08-17 2026 | Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel news 8 min read | Writeup detailing the compromise of Subaru's STARLINK Admin Panel, which allowed unrestricted access to customer vehicles and data. The vulnerability stemmed from an unprotected `/forgotPassword/resetPassword.json` endpoint, enabling account takeover of employee credentials by exploiting an email enumeration endpoint (`/adminProfile/getSecurityQuestion.json`). This allowed attackers to remotely control vehicles, track their location history, and access sensitive PII with minimal victim information. → samcurry.net |
| 2026-08-17 2026 | Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office news 8 min read | Writeup detailing a vulnerability discovery within ClubWPT Gold's back office, stemming from a misconfigured development environment. The research utilized tools like `ffuf` and `GitHack` to uncover an exposed `.env` file containing Alibaba cloud credentials and usernames. Exploiting a weak password ("123456") for the "eg3478" user on the staging environment granted access to sensitive administrative functions, including player KYC details and transaction history. The vulnerability was reported and patched without malicious exploitation. → samcurry.net |
| 2026-08-17 2026 | DOM Purify - dirty namespace bypass intermediate 2 min read XSS | Writeup on a DOMPurify dirty namespace bypass in SVG sanitization. This technique exploits a flawed regular expression in DOMPurify's data attribute validation, which lacks an end-of-string anchor. By defining a custom namespace prefixed with `data-`, an attacker can inject arbitrary attributes like `data-slonser:href="javascript:alert(1)"`, leading to cross-site scripting when the SVG is parsed. The vulnerability was reported and fixed by adding a `+` to the regex. |
| 2026-08-17 2026 | The AWS Console and Terraform Security Gap intermediate 10 min read | Library for identifying security gaps between AWS Console defaults and Terraform-provisioned resources. It details common misconfigurations such as unencrypted RDS instances, vulnerable Lambda resource-based policies leading to "Confused Deputy" vulnerabilities, and unintended AWS IAM password policy resets. The library highlights how Terraform's AWS provider often inherits legacy API defaults, creating weaker security postures than console-created resources, and contrasts this with more secure defaults in Azure and GCP. → blog.includesecurity.com |
| 2026-08-17 2026 | Navigating Lax Load Balancers: When an Intersection Gets You Inside intermediate 7 min read SSRF | Analysis of AWS Elastic Load Balancer (ELB) configurations reveals critical security oversights common in Application Load Balancers (ALBs). Vulnerabilities arise from misconfigured listener rules, including rule shadowing that bypasses authentication (`authenticate-oidc`, `authenticate-cognito`), and IP gate bypasses when backend targets are accessible via alternate routes without the same `source-ip` restrictions. Direct ALB access can also circumvent CloudFront's security controls like WAF. These misconfigurations create unintended exposure paths, making backend services reachable despite configured access controls. → blog.doyensec.com |
| 2026-08-17 2026 | Introducing Session Switcher. Swap Burp Sessions with One Click! beginner 4 min read Burp IDOR | Library for Burp Suite that simplifies authorization testing by allowing users to save and quickly swap HTTP sessions. Session Switcher stores cookies and headers as named sessions within the request editor, eliminating manual copy-pasting. It features auto-update rules to keep sessions synchronized with browser traffic, ensuring tokens remain valid throughout engagements, and offers centralized session management. → blog.doyensec.com |
| 2026-08-15 2026 | Escalating a Blind Upload to RCE via Path Traversal into Cron and DNS-Restricted Callback Bypass intermediate RCE | This bug bounty report details how an unauthenticated file upload vulnerability was escalated to Remote Code Execution (RCE). The attacker exploited a path traversal flaw in the destination directory, allowing them to write files to sensitive server locations. While initial exploitation was blocked by standard RCE methods, the attacker successfully bypassed DNS restrictions for callbacks by leveraging a cron job. This allowed for the eventual achievement of RCE. No specific bounty payout amount was mentioned in the provided text. → infosecwriteups.com |
| 2026-08-15 2026 | AWS Cloud Security Challenge: SSRF, IMDSv2, and Cloud Takeover intermediate SSRF | This Fampay CTF challenge involves exploiting a web application hosted on AWS EC2. The goal is to gain access to sensitive data stored in an S3 bucket. The description hints at the use of Server-Side Request Forgery (SSRF) and Instance Metadata Service version 2 (IMDSv2) as potential attack vectors to achieve cloud takeover and retrieve the flag. The content does not mention a specific bug bounty payout amount. → infosecwriteups.com |
| 2026-08-13 2026 | ERPNext's Document Follow feature exposed unauthorized data news 5 min read IDOR | Writeup detailing three chained authorization failures in Frappe's Document Follow feature, affecting ERPNext. The vulnerabilities, identified as CVE-2026-66000, CVE-2026-66058, and CVE-2026-66059, allow unauthorized users to follow any document, receive email updates with sensitive data, and bypass revocation of follow permissions. The writeup discusses object-level, field-level, and grant-lifetime authorization bypasses, and provides examples of exploitation and auditing steps for administrators. |
| 2026-08-11 2026 | They Gave Me $1,000 After I Found Their Entire Student Database Exposed! intermediate | A cybersecurity researcher discovered a critical vulnerability related to HTTP method override that exposed an entire student database. The researcher responsibly disclosed the issue, and it has since been fixed. The writeup, which has redacted all sensitive information to protect privacy, details the PII exposure. The organization awarded the researcher **$1,000** for finding and reporting this significant security flaw. → infosecwriteups.com |
| 2026-08-10 2026 | Beyond Prompt Injection: Hacking Apple's Private Cloud Compute advanced 9 min read AI | Writeup on CVE-2026-20685, which targets Apple's Private Cloud Compute (PCC), details a path traversal vulnerability in the `darwin-init` process. This flaw allows an attacker to write files as root during node boot, bypassing privacy and security guarantees essential for Apple Intelligence features. The exploit leverages a malformed tar archive to inject malicious files into `/var/db/` while still allowing the PCC node to boot successfully, demonstrating a significant security finding within Apple's inference backbone. |
| 2026-07-31 2026 | CosmosEscape: Taking Over Every Database in Azure Cosmos DB news 6 min read | Tool leveraging .NET reflection bypasses Azure Cosmos DB's Gremlin API sandbox. This "CosmosEscape" vulnerability grants code execution and access to a "Cosmos Master Key," enabling enumeration and full read/write takeover of any database within Azure Cosmos DB, including Microsoft's internal data stores. Microsoft has remediated the issue and implemented platform hardening. → wiz.io |
| 2026-07-30 2026 | Account Takeover Across Multiple Programs via Featurebase Integration intermediate 2 min read Bug Bounty IDOR | Writeup detailing an account takeover (ATO) vulnerability in the Featurebase platform, a feedback and feature request service used by numerous organizations. The vulnerability arises from an Insecure Direct Object Reference (IDOR) where the `userId` parameter in API requests, specifically `POST /api/v1/user/identify` and during account modification via `POST /api/v1/user`, is not properly validated. This allows attackers to change a victim's email or impersonate them by obtaining their access token, leading to account compromise. → infosecwriteups.com |
| 2026-07-29 2026 | How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability news 12 min read | Library for identifying internet-exposed Baseboard Management Controllers (BMC) and assessing risks related to CVE-2013-4786, a 20-year-old IPMI 2.0 vulnerability. This resource details how attackers can obtain password-derived authentication hashes before login, enabling offline cracking, and highlights the significant security implications for data centers, particularly in AI infrastructure where BMC compromise can lead to widespread lateral movement and persistence beneath the operating system. The library aids in visualizing this exposure using tools like BMCRadar. |
| 2026-07-29 2026 | RAG and ruin: why your existing controls may miss AI poisoning attacks advanced 7 min read AI | Library addressing Retrieval-Augmented Generation (RAG) system security, this resource details the risks of AI data poisoning and RAG poisoning. It explains how threat actors can exploit retrieval pipelines by injecting crafted content, leading to misinformation, data leakage, or unauthorized actions. Traditional controls are insufficient against these text-based attacks. The library highlights techniques like semantic optimization and retrieval content crafting used by adversaries and discusses the business impact, citing research showing high attack success rates. It also touches on persistent prompt injection via long-term memory, as demonstrated by the spAIware proof of concept. → intigriti.com |
| 2026-07-29 2026 | How an Unpatched N-Day Let Any Anonymous Visitor Rewrite WooCommerce Prices in ND Booking news 11 min read API Sec Bug Bounty | Writeup detailing CVE-2025–63001, an unpatched vulnerability in the ND Booking WordPress plugin. This flaw allows any unauthenticated visitor to permanently overwrite WooCommerce product prices by exploiting an insecure AJAX handler that lacks proper authorization checks beyond a publicly accessible nonce. The vulnerability is exploitable in the latest version of ND Booking, despite its CVE being assigned for older versions, and affects plugins integrating booking functionality with WooCommerce. → infosecwriteups.com |
| 2026-07-29 2026 | Unprotected admin functionality — PortSwigger Access control vulnerabilities Lab 1 beginner 2 min read Bug Bounty IDOR | Writeup of Broken Access Control vulnerability (BAC-Portswigger-001) affecting an administrative panel. The vulnerability stems from missing authentication and authorization checks, allowing unauthenticated users to discover and access the `/administrator-panel` endpoint via `robots.txt`. This enables unauthorized actions like deleting user accounts, leading to full application compromise, aligning with OWASP Top 10 A01: Broken Access Control. Remediation involves enforcing authentication, implementing authorization checks, and avoiding reliance on `robots.txt` for security. → infosecwriteups.com |
| 2026-07-28 2026 | Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles intermediate 4 min read API Sec | Writeup detailing the exploitation of VE Commercial Vehicles' "My Eicher" fleet management platform, enabling account takeover and control over user fleets. Vulnerabilities in exposed, unauthenticated APIs allowed for the discovery of customer lists, user data, and OTPs, facilitating direct account compromise. This led to the potential control of hundreds of thousands of vehicles and access to sensitive uploaded documents including Aadhaar cards and driving licenses. |
| Browse all 237 Authorization / Broken Access Control resources → | ||
Frequently Asked Questions
- What is broken access control?
- Broken access control occurs when an application fails to enforce restrictions on what authenticated users are allowed to do. This can lead to unauthorized access to other users' data, privilege escalation to admin roles, or performing actions outside the user's intended permissions — such as modifying or deleting resources they should not have access to.
- What is the difference between authentication and authorization?
- Authentication verifies identity (who are you?), while authorization determines permissions (what can you do?). A user can be properly authenticated but still access resources they shouldn't if authorization checks are missing or flawed. Many critical vulnerabilities arise from this distinction being overlooked.
- How do you test for authorization vulnerabilities?
- Test by accessing resources with different user roles, manipulating tokens or session cookies, changing IDs in API requests, and attempting to reach admin endpoints as a regular user. Tools like Autorize (Burp extension) automate this by replaying requests with different session tokens to detect missing authorization checks.
Weekly AppSec Digest
Get new resources delivered every Monday.