Hi Everyone! I recently discovered a Broken Access Control / Privilege Escalation vulnerability in a SaaS platform (ExampleCenter) that allowed a low-privileged user (Scheduler role) to perform editor-level administrative actions via direct API calls.
For this discovery, I was awarded a $700 bounty along with a $100 bonus for retesting. Let’s explore how this bug worked, how I exploited it, and why it was important.
Press enter or click to view image in full size
Understanding the Target
ExampleCenter is a SaaS platform used for managing teams, scheduling, and workflows within organizations. It follows a role-based access control model:
- Editors/Admins → Can manage teams, structure, and permissions
- Schedulers → Can only assign people to existing teams
To maintain proper security boundaries, only Editors and Admin should be able to:
- Create teams
- Copy teams
- Assign team leaders
- Modify team configurations
The UI correctly enforces this restriction by displaying:
“Only editors can create teams.”