Posts tagged "access-control"

June 12, 20262 min read

[Insufficient Authorization] Unauthenticated Delivery-Order API Exposes Other Customers' Personal Data

Masked FVE record: a null accessToken was accepted and order IDs increased sequentially, so anyone could read other customers' phone numbers, names and payment methods without authentication.

Read full article

June 7, 20262 min read

[Account Takeover] Unauthenticated Password Change on a Retail Membership Service

Masked FVE record: an object-level authorization flaw let anyone change another member's password with nothing but an integer member number.

Read full article