Improper Access Control - Access to "Active Hiring" (Premium feature) filter results

Summary

An access control vulnerability is identified in LinkedIn's people search functionality that allows unauthorized access to premium "Active Hiring" filter results. The vulnerability affects www.linkedin.com and specifically targets the premium subscription model by bypassing payment restrictions through API manipulation.

The vulnerability exploits a flaw in the GraphQL API endpoint /voyager/api/graphql where premium feature restrictions are not properly enforced when pagination parameters are modified. Users without active LinkedIn Premium subscriptions are normally prevented from accessing complete "Active Hiring" search results through the user interface, which displays only the first few results before showing an upsell prompt requiring premium subscription activation.

However, the underlying API endpoint fails to validate premium subscription status when the start parameter in the GraphQL query is modified to values other than 0. This allows attackers to bypass the premium paywall by incrementally increasing the pagination offset, effectively harvesting all premium search results that should be restricted to paying subscribers.

The vulnerability also includes a simplified exploitation method through URL manipulation, where users can append pagination parameters like &page=2 directly to search URLs to access additional premium results without any API knowledge or technical manipulation required. The flaw represents an improper access control issue (CWE-284) where business logic fails to consistently enforce subscription-based restrictions across different access vectors, allowing unauthorized users to obtain valuable premium data that LinkedIn monetizes through its subscription model.