Pre-Authentication Payroll History IDOR via a Client-Supplied Employee Identifier
A server-side object authorization flaw in a payroll API allowed an attacker to keep their own identity fixed while changing only the employee identifier in the request path. This exposed other employees’ complete payment histories, including payment amounts, debt adjustments, payroll periods and internal observations.
Description
An employee compensation portal exposed a payment-history endpoint containing an employee identifier in the URL path. The frontend always called the endpoint with the current user's identifier, but the backend did not enforce that relationship.
The server checked only that a client-supplied identity header contained a syntactically valid employee identity. It never compared that principal with the employee identifier requested in the path.
Keeping the caller identity fixed and changing only the path value returned another employee's complete historical payment data.
A second routing weakness made the API reachable without a normal SSO session. A static-looking suffix caused the edge authorization layer to classify the request as a public asset, while the backend normalized the same path and dispatched it to the protected API controller.