Breaking Premium Features: Two Business Logic Vulnerabilities in a Popular Online Design Platform

Introduction

While assessing a popular online design platform through its bug bounty program, i found that some premium featerus only allowed for pro-tier accounts .

First bug : Premium Download Bypass via Public Google CDN URLs.

The application provides image editing and design capabilities with two account tiers:

Free users
Can create and edit designs.
Cannot download or share original-quality images.
Premium users
Can download and share full-resolution assets.

At first i tried to download the design via direct api call but i coulden't.

While browsing the application with Burp Suite, I noticed an API responsible for listing user documents.

The response contained metadata about the user's designs together with image URLs hosted on Google's image CDN.

The URLs looked similar to: https://lh3.googleusercontent.com/.

I opend the link on diffrent browser then found the design downloaded to my device with the original resolution without any authentication .

Reproducing the Issue

Log in using a free account.
Create or access a design.
Intercept the request to:

POST /docs/v1/listDocuments

POST /docs/v1/listDocuments

Locate the Google CDN image URL returned in the response.
Open the modified URL directly in a browser.

The browser immediately serves or downloads the original-quality image.

No premium account is required.

Second Bug: Premium Tag Creation Bypass via Alternate API Endpoint.

While exploring additional APIs, I noticed something interesting.

The application exposes an endpoint dedicated to creating tags.

POST /tag/create

POST /tag/create

Attempting to use it from a free account returned:

Pro subscription required to perform this action.

Pro subscription required to perform this action.

So far everything looked correct. But while analyzing JS files i found some thing , another endpoint for creating tags

as you see the tag created by free-tier account .

To verify whether the tag actually existed, I queried the tag listing endpoint.

Impact

These vulnerabilities allow free-tier users to bypass key subscription controls intended to protect premium functionality. By exploiting inconsistent authorization checks, an attacker can access original-quality assets and use premium-only features without purchasing a Pro subscription.

Conclusion

These findings demonstrate how inconsistent authorization checks across different application workflows can undermine an entire subscription model. Although each issue affected a different feature, both stemmed from the same root cause: business logic was enforced inconsistently. This highlights the importance of applying authorization checks uniformly across all API endpoints that perform privileged actions, rather than relying on individual routes or frontend restrictions alone.

Thanks for reading.

Follow me on:

X: https://x.com/MostafaAyed9

linkedin: https://www.linkedin.com/in/mostafa-ayed-b85271253/