Bug-Bounty | FASTMAIL [topicbox.com: Privileges Escalation > Organization Takeover]

  • Only owners of the organization can create Groups and make other users owners
  • Permissions are separated for each group, for example, I can be an admin in group 1 and be a member in group 2
  • We can break the access controls and escalate ourselves from admin to owner by sending this request #V1
  • isEnternal is a feature that allows users to create their own groups. and automatically the creator will be the admin of the group

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store