Broken Access Control: A Non-Admin User Can Change Site Configuration

بِسْمِ اللهِ الرَّحْمنِ الرَّحِيمِ

إِن يَنصُرۡكُمُ ٱللَّهُ فَلَا غَالِبَ لَكُمۡۖ وَإِن يَخۡذُلۡكُمۡ فَمَن ذَا ٱلَّذِي يَنصُرُكُم مِّنۢ بَعۡدِهِۦۗ وَعَلَى ٱللَّهِ فَلۡيَتَوَكَّلِ ٱلۡمُؤۡمِنُونَ

Hello Bug Bounty Hunters!

I'm Hassan Saad (black_eagle300), and this is the first vulnerability write-up I've ever published. I thought the finding might be useful to others, so I decided to document it here.

Let's jump straight into it.

Understanding the Permission Model

The target was a company that provides a web analytics platform. Website owners can integrate their websites with the platform to collect detailed analytics and user behavior data, helping them better understand how visitors interact with their services.

The platform has a multi-layered permission model.

Organization Level

At the organization level, there is a dedicated Owner role, along with four individual permissions:

• Analytics
• Organization Administration
• Two additional permissions related to the platform's applications

Site/Application Level

Once a website is connected to the platform, it becomes an application managed by the organization. Each application has its own set of permissions:

• Manage
• Edit & Publish
• Edit
• View

Now that we understand how the permission model works, let's move on to the interesting part :

The Finding

A user without Organization Administration permission, but with only Edit permission on a site, should not be able to access or modify the site's administrative settings. Those settings are only available through the organization's administration panel.

That expectation matched the UI. The user couldn't access the settings page and received a permission error.

Out of curiosity, I tried interacting with the same settings through the API instead of the interface. Surprisingly, the requests succeeded, and I was able to modify the site's settings despite lacking administrative privileges.

To make sure this behavior wasn't intentional, I granted the same user the Organization Administration permission. As soon as I did, the exact settings I had already modified through the API became visible in the UI, confirming that they were indeed intended to be accessible only to administrators.

The vulnerability itself was fairly straightforward. The challenging part was understanding the permission model, as the documentation wasn't always clear and the platform had inconsistent authorization behavior between the UI and the API due to its layered permission system.

At first, I wasn't even sure whether this was a valid security issue or simply intended behavior. However, the company ultimately confirmed it as a vulnerability because a user with limited privileges was able to modify administrator-only site settings.

Security Impact

A user without Administration privileges can modify site-level settings that appear to be restricted through the UI.

This may allow lower-privileged users to change tracking and analytics behavior that should only be manageable by users with higher administrative permissions.