How a Free Trial Led to Broken Access Control

Can a free-trial feature let you bypass account restrictions and become a Teacher even if you're not allowed to? That's exactly what I found during this test.

It will be a short story so let's see how it happened.

Understanding the restriction

The platform has two main account types: Student and Teacher. Younger students than 14 have additional restrictions, and they can't switch their account type to Teacher through Settings.

My first attempt was straightforward: intercept the request and try to change my account type directly. The server returned 403 Forbidden. Looks like it was working as expected, right?

Not so fast. 👀

The interesting part

While testing the free-trial feature, I noticed something interesting.

When a Student requests a free trial, the following request is sent:

POST /cart-line-items/create-or-update
{
  "productType": 37,
  "quantity": 1,
  "source": "header_plus"
}

POST /cart-line-items/create-or-update
{
  "productType": 37,
  "quantity": 1,
  "source": "header_plus"
}

This gives the Student a 7-day free trial.

But when a Teacher does the same thing, the productType changes to 15, which gives them a one-month free trial.

That's when I got an idea: what if I changed the product type myself?

One parameter, a different result

I logged in with an underage Student account, intercepted the request, and changed productType from 37 to 15.

I forwarded the request and continued the flow.

And boom!

Instead of being blocked, the account received the Teacher free trial.

But the trial duration wasn't the only thing that changed:

• The account gained Teacher status.
• Teacher-only features became available.
• The underage account restriction was bypassed.

Unfortunately, the report was marked as Not Applicable, and the team fixed the issue during the triage process before they could reproduce it.