🕷️The Organization Had Users… But Nobody Could Own It

Let's Go

Target Overview

While testing the organization role-management logic, I discovered an interesting Business Logic / Broken Access Control vulnerability that allowed an organization to reach a state where it had zero owners.

The application allows organizations to have multiple users with different roles, such as:

• Owner
• Manager
• Viewer

The Main Organisation Business Logic is simple:

An organization should always have at least one active owner.

Discovery

I wanted to see how the application handled the situation where an organization had multiple owners and whether it properly protected the last remaining owner.

And this is where things started to get interesting.

POC Steps

1. Create an organization containing multiple users.
2. Assign two users as owners: → Account A → Owner → Account B → Owner → Account C → Viewer → Account D → Viewer
3. Make sure Account A and Account B are the only owners of the organization.
4. Using Account A, prepare a request that changes its role from: → Owner → Viewer and drop main request and send request to repeater.
5. Using Account B, prepare another request that changes its role from: → Owner → Viewer and drop main request and send request to repeater.
6. Send both role-change requests concurrently using Burp Suite Repeater.
7. Observe the final state of the organization.

Result

Both requests were successfully processed.

The final organization state became:

→ Account A → Viewer → Account B → Viewer → Account C → Viewer → Account D → Viewer

And the most interesting part:

Owners: 0

The organization remained active and still contained users, but no user had the Owner role anymore.

This means the organization entered a state where there was no user capable of performing owner-level administrative actions.

The application allowed me to violate a business rule that should always remain true:

An organization must always have at least one active owner.

Root Cause

The backend does not properly protect the last owner.

When both owners change their roles at the same time, the backend allows both requests because each request sees that another owner still exists.

As a result:

Owner A → Viewer Owner B → Viewer

Leaving the organization with: 0 Owners

The application should always make sure that at least one owner remains.

Report Status

Let's Connect: x account || linkedin || facebook [new]

"سُبْحَانَكَ اللَّهُمَّ وَبِحَمْدِكَ ، أَشْهَدُ أَنْ لا إِلَهَ إِلا أَنْتَ ، أَسْتَغْفِرُكَ وَأَتُوبُ إِلَيْكَ"