BFLA ---- on GraphQL getMe query allows unauthorize access to low privileged user

Summary#

The biller (Billing Viewer) role is strictly intended to view limited billing information and should not have access to shared resources or team settings. However, by making a crafted GraphQL request to the getMe query, a user with the biller role can retrieve sensitive details about the account, including team configurations, uuids, droplet counts, resource limits, and SSO configurations for all associated organizations. This violates the principle of least privilege.

impact#

An attacker with a low-privileged biller role can:

1. Enumerate all teams/organizations associated with the account.
2. Infrastructure Reconnaissance: See exactly how many droplets are running (droplet_count) and the total limits (droplet_limit), which is sensitive operational data.
3. Leaking Internal Identifiers: Access uuid and current_context_urn which can be used in other API calls to further probe for more vulnerabilities.