Insecure Direct Object Reference (IDOR) (CWE-639)CVSS 7.5€2,000
Scaling IDOR: Automated PII Exfiltration via Notification Configuration Endpoints
An IDOR vulnerability in a notification configuration endpoint allows an authenticated attacker to modify org_id and username_id to access sensitive user data from other organizations (email, phone, role, etc.).
🎯 The Target
This program manages organizations similar to Slack or Microsoft Teams. Within these organizations, there are multiple users. As an organization administrator, there is an option to configure the notifications that each selected user within the organization will receive. The IDOR vulnerability is found in the request made when changing this configuration, revealing very confidential information about users from all organizations, such as name, phone number, email address, etc.
Proof Of Concept
- Request