Browse / Bypasses / Authorisation and access checks

Getting past authorisation and access checks

Permission, role, ownership and paywall checks. 296 disclosed reports got past one; the 100 most upvoted are below.

1. SSRF in Exchange leads to ROOT access in all instancesServer-Side Request Forgery (SSRF) · medium · Shopify
   587 votes
2. Flickr Account Takeover using AWS Cognito APIImproper Authentication - Generic · critical · Flickr
   440 votes
3. TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesServer-Side Request Forgery (SSRF) · critical · Slack
   $3,500323 votes
4. XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspxXML External Entities (XXE) · critical · Starbucks
   319 votes
5. bd-j exploit chainPrivilege Escalation · high · PlayStation
   $20,000298 votes
6. [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive informationMisconfiguration · medium · Eternal
   $550246 votes
7. Discoverability by phone number/email restriction bypassImproper Access Control - Generic · high · X / xAI
   $5,040217 votes
8. SSRF in webhooks leads to AWS private keys disclosureServer-Side Request Forgery (SSRF) · high · Omise
   214 votes
9. Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formImproper Authorization · medium · HackerOne
   $10,000208 votes
10. XSS and cache poisoning via upload.twitter.com on ton.twitter.comCross-site Scripting (XSS) - Generic · X / xAI
    198 votes
11. Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.comImproper Access Control - Generic · medium · Shopify
    181 votes
12. Path traversal in filename in LINE Mac clientPath Traversal · high · LY Corporation
    175 votes
13. Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphqlCode Injection · high · HackerOne
    $7,000174 votes
14. bypass sql injection #1109311SQL Injection · medium · Acronis
    164 votes
15. RCE as Admin defeats WordPress hardening and file permissionsPath Traversal · critical · WordPress
    164 votes
16. inDriver Job - Admin Approval BypassIncorrect Authorization · medium · inDrive
    $1,000157 votes
17. Undocumented `fileCopy` GraphQL APIImproper Access Control - Generic · medium · Shopify
    $2,000157 votes
18. Blu-ray Disc Java Sandbox Escape via two vulnerabilities Execution with Unnecessary Privileges · medium · PlayStation
    $5,000146 votes
19. Server Side Request Forgery (SSRF) in webhook functionalityServer-Side Request Forgery (SSRF) · medium · HackerOne
    $2,500140 votes
20. Mint Oauth2 access token for targeted userImproper Authentication - Generic · high · GitLab
    $5,580140 votes
21. IP restriction bypass via X-Forwarded-For headerForced Browsing · low · Acronis
    $250126 votes
22. Netlify Authentication Token Exposed in Public Mozilla CI LogsInformation Disclosure · critical · Mozilla
    123 votes
23. Improper HTTP header block termination in llhttpHTTP Request Smuggling · medium · Node.js
    122 votes
24. Server-Side Request Forgery (SSRF) via Game Export APIServer-Side Request Forgery (SSRF) · critical · Lichess
    116 votes
25. Previous commentor on post can still comment even after comment permission is changed to disabledImproper Access Control - Generic · low · LinkedIn
    112 votes
26. Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationInsecure Direct Object Reference (IDOR) · medium · GitHub
    108 votes
27. Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerImproper Restriction of Authentication Attempts · medium · Acronis
    106 votes
28. Able to bypass authorization logic and gain more access then intendedImproper Access Control - Generic · medium · GitHub
    105 votes
29. 2FA requirement bypass when inviting team membersImproper Access Control - Generic · medium · Omise
    105 votes
30. SQL injection in https://www.acronis.cz/ via the log parameterSQL Injection · medium · Acronis
    103 votes
31. SQL Injection intensedebate.comSQL Injection · medium · Automattic
    102 votes
32. Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scopePrivacy Violation · medium · Nextcloud
    $250101 votes
33. Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)Improper Access Control - Generic · medium · Nextcloud
    $150100 votes
34. Improper Access Control - Access to "Active Hiring" (Premium feature) filter results Improper Access Control - Generic · medium · LinkedIn
    100 votes
35. Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)Improper Input Validation · low · Mozilla
    98 votes
36. Cross-origin resource sharing misconfig | steal user information Misconfiguration · medium · Semrush
    97 votes
37. Saying goodbye to HackerOne and Gratipay.Gratipay
    96 votes
38. Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.orgImproper Input Validation · low · Mozilla
    $50093 votes
39. `exportReportPdf` mutation shows internal Activityhigh · HackerOne
    92 votes
40. [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierServer-Side Request Forgery (SSRF) · critical · Stripo Inc
    92 votes
41. Injection in path parameter of Ingress-nginxCode Injection · high · Kubernetes
    91 votes
42. IDOR - Leaking of team data (name, email, ID, member ID) via POST /api/v1/graphql `FetchMemberships` operationInsecure Direct Object Reference (IDOR) · medium · Tools for Humanity
    $50091 votes
43. Bypass report submit restriction/ban using the API keyPrivilege Escalation · medium · HackerOne
    91 votes
44. Bypassing the block of Security Domain Restriction and normally invite blocked domains with special characters “İ”Business Logic Errors · medium · Frontegg
    88 votes
45. IDOR to view order information of users and personal informationInsecure Direct Object Reference (IDOR) · medium · Affirm
    $50087 votes
46. Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signingBusiness Logic Errors · medium · MetaMask
    $35086 votes
47. Bypass invite accept for victimBusiness Logic Errors · medium · Slack
    84 votes
48. PIN 📌 BYPASS 🥷Improper Authentication - Generic · high · Yoti
    84 votes
49. Business Logic Bypass Allows Setting “Read Access” Role Without Pro Plan SubscriptionBusiness Logic Errors · medium · Lovable VDP
    78 votes
50. Using special IPv4-mapped IPv6 addresses to bypass local IP banImproper Access Control - Generic · critical · Cloudflare Public Bug Bounty
    $7,50078 votes
51. SQL Injection in Django ORM via Unvalidated `_connector` in Q ObjectsSQL Injection · critical · Django
    77 votes
52. IDOR - Scheduled data leak to other accounts By "projectID"Business Logic Errors · medium · SingleStore
    77 votes
53. TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk BotInsecure Direct Object Reference (IDOR) · medium · Nextcloud
    73 votes
54. X-Forward-For Header allows to bypass access restrictionsImproper Access Control - Generic · medium · Yelp
    73 votes
55. BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOSImproper Access Control - Generic · medium · TikTok
    $50072 votes
56. Bypass validation parts in AWS IAM Authenticator for KubernetesImproper Authentication - Generic · high · Kubernetes
    $2,50068 votes
57. Authorization bypass using login by phone option+horizontal escalation possible on Grab Android AppImproper Authentication - Generic · high · Grab
    68 votes
58. Path traversal by monkey-patching Buffer internalsPath Traversal · high · Internet Bug Bounty
    $2,43067 votes
59. HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate APIMissing Required Cryptographic Step · low · CoinMate.io
    66 votes
60. Login email verification bypass via `/oauth/token`.Missing Critical Step in Authentication · GitLab
    66 votes
61. BAC – Bypass chatbot restrictions via unauthorized mention injectionImproper Access Control - Generic · medium · Dust
    65 votes
62. JaaS SIP Gateway Authorization BypassMissing Authorization · medium · 8x8
    $50064 votes
63. Bypass SMS verification to delete TikTok accountImproper Authorization · low · TikTok
    64 votes
64. Fail-Open in set_tlsext_servername_callback on pyopenssl via unhandled exceptions leads to security bypassImproper Access Control - Generic · low · Python Cryptographic Authority
    63 votes
65. Bypassing Bronze Partner Wallet Restriction to Accept Trips with Negative BalanceBusiness Logic Errors · medium · Bykea
    63 votes
66. Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10OS Command Injection · critical · Trellix
    60 votes
67. QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions DenialImproper Access Control - Generic · AWS VDP
    59 votes
68. Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository TransferImproper Access Control - Generic · medium · GitHub
    57 votes
69. Bypass R2 payment screenImproper Restriction of Authentication Attempts · medium · Cloudflare Public Bug Bounty
    $35057 votes
70. Ingress nginx annotation injection causes arbitrary command executionCode Injection · high · Kubernetes
    $2,50057 votes
71. Blocking a company page admin prevents him from delete paid media admin or edit his rolesImproper Access Control - Generic · medium · LinkedIn
    55 votes
72. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high · GitLab
    55 votes
73. Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)Server-Side Request Forgery (SSRF) · medium · Node.js
    52 votes
74. Race Conditions in OAuth 2 API implementationsImproper Authentication - Generic · medium · Internet Bug Bounty
    52 votes
75. User Limit Bypass via Pending Invitations in Workspace SystemBusiness Logic Errors · medium · Dust
    51 votes
76. SELECT ... INTO OUTFILE does not enforce the FILE WRITE privilege unprivileged arbitrary file write on the serverMissing Authorization · high · SingleStore
    50 votes
77. Unauthorized Blogs CreationImproper Access Control - Generic · low · Lichess
    50 votes
78. Race condition leads to add more than 5 email at Data breaches monitor system at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.netConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low · Mozilla
    50 votes
79. launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API Improper Authentication - Generic · high · Basecamp
    49 votes
80. SQL injection in https://demor.adr.acronis.com/ via the username parameterSQL Injection · high · Acronis
    49 votes
81. Bypass comment restrictionImproper Access Control - Generic · medium · HackerOne
    48 votes
82. Remote Code Execution in Basecamp Windows Electron AppCode Injection · high · Basecamp
    48 votes
83. H1514 Bypass Wholesale account signup restrictionsImproper Access Control - Generic · medium · Shopify
    48 votes
84. Broken Access Control allows advertiser accounts to delete trackers they do not ownImproper Access Control - Generic · high · Revive Adserver
    47 votes
85. Unauthenticated API Access Exposing Premium Content and Financial DataInformation Exposure Through Sent Data · XVIDEOS
    46 votes
86. Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijackingOut-of-bounds Read · high · MariaDB
    43 votes
87. Blind SQL Injection SQL Injection · critical · MTN Group
    43 votes
88. Moodle XSS on evolve.glovoapp.comCross-site Scripting (XSS) - Reflected · medium · Glovo
    41 votes
89. Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin ActionsImproper Authentication - Generic · high · Monero
    40 votes
90. Broken Access Control on **healthwatch.trellix.com** Leading to Unauthorized Access and Sensitive Data ExposureImproper Access Control - Generic · medium · Trellix
    40 votes
91. Improper Access Control allows OTP bypassImproper Access Control - Generic · medium · Lark Technologies
    40 votes
92. Onion-Location header allows to open arbitrary URLs including chrome:Violation of Secure Design Principles · high · Brave Software
    40 votes
93. [HTA2] Authorization Bypass on https://██████ leaks confidential aircraft/missile informationImproper Authorization · critical · U.S. Dept Of Defense
    40 votes
94. Misconfiguration in Two Factor AuthorisationImproper Authentication - Generic · Shopify
    $1,50040 votes
95. Insecure Direct Object Reference (IDOR) allows creating folders.Insecure Direct Object Reference (IDOR) · low · SingleStore
    39 votes
96. Blind Sql Injection https:/████████SQL Injection · medium · U.S. Dept Of Defense
    39 votes
97. IBM Maximo Asset Management could allow a remote attacker to bypass authentication due to improper access controlsImproper Access Control - Generic · medium · IBM
    37 votes
98. Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groupsImproper Access Control - Generic · medium · Nextcloud
    36 votes
99. Exposure of a valid Gitlab-Workhorse JWT leading to various bad thingsImproper Authentication - Generic · high · GitLab
    $10,00036 votes
100. MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeoverImproper Access Control - Generic · high · MariaDB
     35 votes