PentestingHere
Log in Join
[LOW] · Bugcrowd P4 · Unresolved

Broken Access Control – Low-Privilege Custom Role Can Access Test Settings via Unauthorized API Endpoint

Abdulrahman Zourob Abdulrahman Zourob Web application 16 Aug 2026

The affected asset is anonymised at the researcher's request.

Summary

A Broken Access Control / Privilege Escalation issue in Cisco ThousandEyes allowed a low-privileged custom-role user to access Test Settings data through an unauthorized backend API.

Steps

  1. Create/use a custom role without Test Settings permissions.
  2. Log in as the restricted user.
  3. Access the Test Settings page → access denied.
  4. Send a direct request to /ajax/agent/view/generic-tests.
  5. The API returns 200 OK with test configuration data the user should not access.

Impact

  • Access unauthorized monitoring tests and configurations.
  • Enumerate test IDs and monitoring settings.
  • Discover monitored infrastructure/endpoints.
  • Obtain internal reconnaissance information that could support further attacks.