Non Org Admin/Group Manager can create groups in an organization

Summary

This report describes a privilege escalation vulnerability that allows a user with only "Program Admin" permissions, to escalate their privileges to higher levels like "Report Manager" or even full administrator privileges under certain circumstances.

The vulnerability exists due to a mutation in the GraphQL API that lets a low privileged attacker assign themselves to the default admin groups created when a new program is set up. By assigning themselves to these groups, the attacker gains elevated permissions like the ability to modify reports, award bounties, manage users and groups, etc.

The issue is amplified if the organization admin later modifies the permissions for the default admin groups, as the attacker can then re-assign those groups to themselves and inherit the new elevated permissions.

In summary, this allows an unauthorized privilege escalation from a low privileged state to potentially full administrative control over a program. The reporter provided clear reproduction steps and worked closely with the HackerOne team to validate the issue. After confirming it was a valid high severity vulnerability, a fix was implemented and the report was resolved.