Bypass R2 payment screen

Summary

Cloudflare's object storage product, R2, requires customers to have a valid payment method on file in order to activate the subscription. Due to insufficient access control checks, it was possible to bypass this requirement and enable the R2 subscription without having a valid payment method stored. Cloudflare's engineering team fixed the issue by implementing stricter access control methods around subscription enablement.

I discovered that if you clicked Add R2 subscription to my account fast enough - before the Payment field loads - it would bypass R2's requirement to add a payment method to your account to prevent abuse. It also allowed you to bypass this by just sending an API request to the R2 signup endpoint.

https://stealing.info/cloudflare-r2-payment-bypass/