How I found BAC leads to De-escalate the Administrator privilege

This bug enables me to De-escalate any user in my organization has an administrator role (( The highest role )) to a lower privilege Although i don't have the permission to do so

The Program

The program was an organization based program , The flaw was in the function of inviting users to the team or the organization, But first let me show you the roles

Administarator ==> The role which can control everything in the organization

Internal User ==>This role has permissions on some function including the invitation , But Internal user can only invite user with the same privilege (( Internal user )) so he can't invite user and give him the admin privilege

External User ==> This role isn't a part of our attack , so I won't discuss it to save our time

The Bug

While Moving though the program I found the function of inviting users

As an attacker I had the "Internal User" Role and the Victim was the administrator

• attacker email ==> attacker@gmail.com
• Victim Email ==> victim@gmail.com

If an attacker tried to invite any user , The invitation request is forwarded to the admin for approval or rejection as in the following image ( From admin view )

Let's think for a while.. The attacker has a lower role in organization and the victim has an administrator role and the invitation of the attacker must be accepted from the admin and the invited user is assigned to role "Internal user" … I chained all this together and the idea lighted in mind … I tried to invite the admin himself , I expected that the web app say that the email already exists , but it didn't and the admin was invited as a normal user and the invitation was forwarded to admin's approval page … but for my surprise i found that the admin was no longer an admin in the organization and he can't do any of his functions like approve the invitations … see

The buttons of accepting and ignoring had disappeared … So the admin is no longer an admin logically but in UI it has admin role but ha can't manage any more the organization… The bug depends on the logic and deep understanding of the program

Hope you enjoyed ❤