IDOR — Unauthorized Access to Another User’s Profile Information

Summary#

An IDOR/BOLA vulnerability was identified in the profile API. An authenticated user could access another user’s profile information by modifying the user_id parameter in the API request.

The server validated the client_id, but did not properly verify whether the authenticated user was authorized to access the profile associated with the supplied user_id.

Steps to Reproduce#

1. Create two separate accounts: Account A and Account B.
2. Log in to Account A and navigate to the Profile page.
3. Intercept the API request used to retrieve the profile information:

GET /api/profile?user_id=<USER_ID>&client_id=<CLIENT_ID>

4. Change the client_id to an invalid value and resend the request. The server correctly returns: