Post cover image

July 19, 2026

How I Earned a $300 Bug Bounty by Finding an Authorization Bypass in a Private Program

Authorization vulnerabilities are often overlooked because they don’t always involve complex exploits. Sometimes, a single…

By ameensec

1 min read

Authorization vulnerabilities are often overlooked because they don't always involve complex exploits. Sometimes, a single client-controlled parameter is enough to expose sensitive information.

In this private bug bounty engagement on target.com, I discovered an authorization bypass in a voucher API that allowed access to voucher details by simply manipulating a query parameter. The report was accepted, and I received a $300 bounty.

Discovery

While testing the voucher related APIs, I noticed the endpoint below returned different responses depending on the value of the userMode_eq parameter.

GET /tickets/v1/612?membershipId_eq=887c3dd6-02d1-4b4b-9714-b85d80629d9e&userMode_eq=2 HTTP/2
Host: target.com

The server responded with:

{
  "code": 400,
  "errorCode": 5001,
  "errorMessage": "This voucher is not applicable to you",
  "data": null,
  "success": true
}

At first glance, everything appeared to be working correctly because the API denied access to the voucher.

Testing the Parameter

Instead of changing the voucher ID or membership ID, I focused on the userMode_eq parameter.

I changed:

userMode_eq=2

to

userMode_eq=

The modified request became:

GET /tickets/v1/612?membershipId_eq=887c3dd6-02d1-4b4b-9714-b85d80629d9e&userMode_eq= HTTP/2
Host: target.com

Surprisingly, the API no longer rejected the request. Instead, it returned HTTP 200 along with the complete voucher information.

Information Disclosed

The response exposed data that should only be available to authorized users, including:

  • Voucher title
  • Voucher description
  • Redemption instructions
  • Expiry dates
  • Voucher amount
  • Redemption limits
  • Voucher image URL
  • Voucher status
  • Additional voucher metadata

Although this did not allow voucher redemption, it clearly demonstrated that the authorization check could be bypassed simply by manipulating a client-controlled parameter.

Issue

The backend trusted the value of userMode_eq when determining whether the user was authorized to access the voucher.

When the parameter was empty (or omitted in certain cases), the authorization validation was skipped, allowing the API to disclose information that should have remained protected.

Authorization decisions should always be enforced on the server and must never depend on client-supplied parameters.

Impact

This issue resulted in an authorization bypass that exposed voucher information intended only for eligible users.

An attacker could enumerate voucher details and collect sensitive promotional information without meeting the required eligibility checks.