LogicalBreach Academy

IDOR leads Unauthorized Staff Member Removal via Insufficient Authorization Checks | Free Bug Bounty Writeup | LogicalBreach Academy

BackIDOR leads Unauthorized Staff Member Removal via Insufficient Authorization Checks

Insecure Direct Object Reference (IDOR) (CWE-639)CVSS 6.5€470

IDOR leads Unauthorized Staff Member Removal via Insufficient Authorization Checks

heroxo9868

March 17, 2026

2 min 199

Save

Missing authorization checks allow unauthorized users to remove staff members from accounts they do not own, leading to potential disruption and abuse.

Vulnerability Details

Endpoint:

POST /account/dashboard/accounts HTTP/2

Request Payload:

MemberId=76671&RemoveMember=remove

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

Discussion

No comments yet.

Be the first to share your thoughts