IDOR — Unauthorized Access to Other Users’ Support Tickets

Summary#

An IDOR vulnerability was identified in the Support Tickets API. By modifying the ticket ID in the request, an authenticated user could access the details of a support ticket belonging to another account.

The application did not properly verify that the requested ticket belonged to the currently authenticated user.

Steps to Reproduce#

1. Create two separate accounts: Account A and Account B.
2. Log in to Account A.
3. Navigate to Support → My Tickets.
4. Open a support ticket belonging to Account A.
5. Intercept the request responsible for retrieving the ticket details:

GET /api/support/tickets/00000000000

6. Replace the ticket ID with the ID of a ticket belonging to Account B.
7. Send the modified request.
8. The API returns the details of Account B's support ticket.