The affected asset is anonymised at the researcher's request.
blogpost: https://www.nyx0r.me/writeup/privesc-to-application-admin provided with screenshots Vulnerability class: Broken Function Level Authorization
Summary
The target application is a production risk-management tool used in healthcare facilities to log incidents, evaluate risk, and generate mitigation reports. It defines four roles: Application Admin / Super Admin, Project Manager, Coordinator, and Member.
Both Super Admin and Project Manager roles share a single /create user-creation endpoint. The server authenticates the request by decoding the caller's JWT and checking that role is super_admin or project_admin. However, it never validates the role field supplied in the request body — the role being assigned to the new account.