Browse / Access Control

Access Control

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Improper Access Control - Generic888
• Privilege Escalation464
• Improper Authorization55
• Client-Side Enforcement of Server-Side Security20
• Forced Browsing14
• Incorrect Authorization13
• Reliance on Untrusted Inputs in a Security Decision8
• Improper Privilege Management7
• Missing Authorization7
• Improper Handling of Insufficient Permissions or Privileges4
• Incorrect Permission Assignment for Critical Resource3
• Execution with Unnecessary Privileges3
• Improper Export of Android Application Components2
• Incorrect Privilege Assignment2
• Incorrect Default Permissions2
• Access Control Check Implemented After Asset is Accessed1
• Improper Preservation of Permissions1

Often found together with

• Information Disclosure209
• Misconfiguration200
• Authentication179
• Insecure Direct Object Reference104
• Cross-site Scripting72
• Code Execution70
• Cross-Site Request Forgery61

Most upvoted Access Control reports

AllValidInformativeN/ADuplicate

1. Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOPrivilege Escalation · critical · Shopify
   1,922 votes
2. Account Takeover via Password Reset without user interactionsImproper Access Control - Generic · critical · GitLab
   $35,000989 votes
3. [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationPrivilege Escalation · critical · Shopify
   894 votes
4. Exfiltrate and mutate repository and project data through injected templated serviceImproper Access Control - Generic · critical · GitLab
   $11,000762 votes
5. Email address of any user can be queried on Report Invitation GraphQL type when username is knownImproper Authorization · high · HackerOne
   671 votes
6. Getting all the CD keys of any gameImproper Access Control - Generic · critical · Valve
   $20,000638 votes
7. Ability to reset password for accountImproper Access Control - Generic · critical · Upserve
   637 votes
8. Publicly accessible Continuous Integration ToolImproper Access Control - Generic · critical · Snapchat
   562 votes
9. Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationPrivilege Escalation · critical · Shopify
   559 votes
10. Shopify Stocky App OAuth MisconfigurationPrivilege Escalation · medium · Shopify
    527 votes
11. One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comImproper Access Control - Generic · critical · Reddit
    509 votes
12. Able to Become Admin for Any LINE Official AccountPrivilege Escalation · critical · LY Corporation
    493 votes
13. Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsPrivilege Escalation · critical · GitLab
    $12,000457 votes
14. Reset password link sent over unsecured http protocolImproper Access Control - Generic · high · Mattermost
    $750440 votes
15. Full account takeoverImproper Access Control - Generic · high · Reverb.com
    412 votes
16. Read-only application can publish/delete fleetsPrivilege Escalation · medium · X / xAI
    398 votes
17. Cross-organization data access in city-mobil.ruImproper Access Control - Generic · Mail.ru
    $8,000374 votes
18. Multiple bugs leads to RCE on TikTok for AndroidImproper Export of Android Application Components · critical · TikTok
    371 votes
19. Attacker is able to access commit title and team member comments which are supposed to be privateImproper Access Control - Generic · high · GitLab
    351 votes
20. Private list members disclosure via GraphQLImproper Access Control - Generic · low · X / xAI
    346 votes
21. [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious FileImproper Access Control - Generic · Mail.ru
    340 votes
22. [Razer Pay Mobile App] Broken access control allowing other user's bank account to be deletedImproper Authorization · Razer
    $1,000311 votes
23. Subdomain takeover of datacafe-cert.starbucks.comPrivilege Escalation · high · Starbucks
    311 votes
24. Shopify admin authentication bypass using partners.shopify.comImproper Authorization · critical · Shopify
    311 votes
25. Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationImproper Access Control - Generic · medium · Shopify
    310 votes
26. Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.comIncorrect Authorization · critical · GitLab
    306 votes
27. bd-j exploit chainPrivilege Escalation · high · PlayStation
    $20,000298 votes
28. Exposed proxy allows to access internal reddit domainsImproper Access Control - Generic · high · Reddit
    $7,500296 votes
29. Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`Improper Access Control - Generic · critical · HackerOne
    $25,000295 votes
30. [CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/startImproper Access Control - Generic · critical · Remitly
    291 votes
31. Golden techniques to bypass host validations in Android appsImproper Access Control - Generic · ██████
    278 votes
32. Team member with Program permission only can escalate to Admin permissionPrivilege Escalation · medium · HackerOne
    268 votes
33. Organization TakeoverImproper Access Control - Generic · high · Helium
    $500263 votes
34. View Titles of Private Reports with pending email invitationImproper Access Control - Generic · high · HackerOne
    257 votes
35. Privilege escalation from any user (including external) to gitlab admin when admin impersonates youPrivilege Escalation · critical · GitLab
    256 votes
36. access list owner can escalate his role to the highest rolesPrivilege Escalation · Teleport
    $21,000255 votes
37. Stealing Users OAuth authorization code via redirect_uriImproper Authorization · high · pixiv
    $2,000253 votes
38. Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainReliance on Untrusted Inputs in a Security Decision · medium · GitLab
    249 votes
39. Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgImproper Access Control - Generic · critical · Starbucks
    247 votes
40. Shopify Partners Invitation Process Allows Privilege Escalation Without Email VerificationImproper Access Control - Generic · medium · Shopify
    245 votes
41. Linux privilege escalation via trusted $PATH in keybase-redirector Privilege Escalation · Keybase
    $5,000245 votes
42. Account takeover of existing HackerOne accounts through SCIM provisioningImproper Access Control - Generic · high · HackerOne
    232 votes
43. 1 Click Account Takeover via Auth Token Theft on marketing.hostinger.comImproper Access Control - Generic · high · hostinger
    219 votes
44. Discoverability by phone number/email restriction bypassImproper Access Control - Generic · high · X / xAI
    $5,040217 votes
45. Group search leaks private MRs, code, commitsImproper Access Control - Generic · high · GitLab
    212 votes
46. Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Improper Access Control - Generic · low · Uber
    $4,500210 votes
47. Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formImproper Authorization · medium · HackerOne
    $10,000208 votes
48. Privilege escalation in workers container Privilege Escalation · high · Semmle
    $1,500206 votes
49. Able to bypass email verification and change email to any other user email Improper Access Control - Generic · high · Reddit
    $5,000200 votes
50. Admin Management - Login Using Default Password - Leads to Image Upload Backdoor/ShellImproper Access Control - Generic · Razer
    $200199 votes
51. Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiImproper Access Control - Generic · high · GitHub
    198 votes
52. Verify any unused email addressImproper Access Control - Generic · X / xAI
    $560197 votes
53. SAML Signature verification bypass allows logging into any user (with specific conditions)Improper Access Control - Generic · critical · GitHub
    196 votes
54. Through blocking the redirect in /* the attacker able to bypass Authentication To see Sensitive Data sush as Game Keys , Emails ,..Improper Access Control - Generic · Razer
    $1,000196 votes
55. Helpdesk Takeover at dmc.datastax.comReliance on Untrusted Inputs in a Security Decision · high · DataStax
    195 votes
56. TikTok 2FA BypassImproper Authorization · medium · TikTok
    $1,564194 votes
57. Incorrect control of the trial periodClient-Side Enforcement of Server-Side Security · Nord Security
    188 votes
58. Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Improper Access Control - Generic · high · Reddit
    186 votes
59. SOP bypass using browser cacheImproper Access Control - Generic · Keybase
    185 votes
60. Unauthenticated access to sensitive user informationImproper Privilege Management · Razer
    $500184 votes
61. Authentication bypass on gist.github.com through SSH CertificatesImproper Access Control - Generic · high · GitHub
    $10,000182 votes
62. Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.comImproper Access Control - Generic · medium · Shopify
    181 votes
63. Worker container escape lead to arbitrary file reading in host machine [again]Privilege Escalation · critical · Semmle
    $2,000178 votes
64. Access token stealing.Missing Authorization · high · PlayStation
    $1,200177 votes
65. Previously created sessions continue being valid after MFA activationImproper Access Control - Generic · medium · Superhuman (formerly Grammarly)
    176 votes
66. 1 click Account takeover via deeplink in [com.kayak.android]Improper Access Control - Generic · critical · KAYAK
    173 votes
67. IDOR in the https://market.semrush.com/Improper Access Control - Generic · critical · Semrush
    173 votes
68. User can delete data in shared folders he's not autorized to accessImproper Access Control - Generic · medium · Nextcloud
    173 votes
69. [IDOR] API endpoint leaking sensitive user informationImproper Access Control - Generic · Razer
    $375172 votes
70. Misconfigured s3 Bucket exposureImproper Access Control - Generic · Razer
    $500168 votes
71. Ability To Takeover any account by Emaill.Privilege Escalation · Radancy
    168 votes
72. [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)Incorrect Permission Assignment for Critical Resource · medium · Shopify
    $3,100166 votes
73. Subdomain takeover of storybook.lystit.comPrivilege Escalation · high · Lyst
    $1,000163 votes
74. inDriver Job - Admin Approval BypassIncorrect Authorization · medium · inDrive
    $1,000157 votes
75. Undocumented `fileCopy` GraphQL APIImproper Access Control - Generic · medium · Shopify
    $2,000157 votes
76. CRITICAL ISSUE : Leak of all accounts mail login md5 pass and moreImproper Access Control - Generic · Pornhub
    157 votes
77. Can delete other user's post and company page postImproper Access Control - Generic · LinkedIn
    156 votes
78. Access to TarantoolImproper Access Control - Generic · Mail.ru
    $4,000155 votes
79. Access to the business emails of Rockstar Support agents through the support platformImproper Access Control - Generic · low · Rockstar Games
    $550151 votes
80. Banned user still has access to their deleted account via HackerOne's API using their API keyImproper Access Control - Generic · medium · HackerOne
    150 votes
81. [ Spot Check ] Team members can edit a user's write-upImproper Access Control - Generic · low · HackerOne
    149 votes
82. Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"Improper Authorization · critical · Insightly
    148 votes
83. Account takeover - improper validation of jwt signature (with regards to experiation date claim)Improper Authorization · high · Linktree
    147 votes
84. [mcs.mail.ru] Пользователь с ролью наблюдателя может создавать ключи доступа для очереди сообщений (sqs.mcs.mail.ru)Improper Access Control - Generic · Mail.ru
    $15,000147 votes
85. Blu-ray Disc Java Sandbox Escape via two vulnerabilities Execution with Unnecessary Privileges · medium · PlayStation
    $5,000146 votes
86. User with removed manage shops permissions is still able to make changes to a shop Improper Access Control - Generic · medium · Shopify
    145 votes
87. Bug in GraphQL and API integration leads to limited user address disclosureImproper Access Control - Generic · high · Starbucks
    144 votes
88. Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.mil Improper Access Control - Generic · critical · U.S. Dept Of Defense
    142 votes
89. Ticket Trick at https://account.acronis.comImproper Access Control - Generic · high · Acronis
    142 votes
90. [Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.Improper Access Control - Generic · critical · Stripo Inc
    140 votes
91. Banned researcher gets email updates on a private program.Improper Access Control - Generic · HackerOne
    139 votes
92. Unauthenticated users can access all food.grammarly.io user's dataImproper Access Control - Generic · low · Superhuman (formerly Grammarly)
    138 votes
93. Takeover of hackerone.engineering via GithubPrivilege Escalation · medium · HackerOne
    135 votes
94. Create free Shopify application credits.Improper Access Control - Generic · medium · Shopify
    134 votes
95. Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH)Improper Access Control - Generic · high · Superhuman (formerly Grammarly)
    $800134 votes
96. Subdomain takeover at info.hacker.onePrivilege Escalation · low · HackerOne
    134 votes
97. Disclosure handle private program with external linkImproper Access Control - Generic · medium · HackerOne
    $2,500130 votes
98. 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationImproper Access Control - Generic · critical · Khan Academy
    126 votes
99. Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License AbuseImproper Access Control - Generic · low · HackerOne
    126 votes
100. IP restriction bypass via X-Forwarded-For headerForced Browsing · low · Acronis
     $250126 votes