#110 · IDOR / privilege escalation via predictable IDs
+240 pts on merge
Claim on GitLab
Submit a merge request that closes this issue to earn points on merge — bounties stack on the standard
+40 merge_pr award. New to the repo? See the
Contributing guide,
and Local Development & SSO
to run the app locally (
cp .dev.vars.example .dev.vars && pnpm dev, after rebasing on main) and fully test your change before opening the MR.
Description
Any endpoint that returns or mutates data keyed on a user-supplied ID without verifying the requesting user owns that ID.
Likely surfaces
/profile/<userId>— does it leak private fields when target_userId != session.userId?- Award-request approve/reject — does it check the row belongs to the admin's review-set, or just trust the URL ID?
- Field Notes article visibility — community vs private
- Task Exchange bid endpoints
- Anywhere a numeric autoincrement ID flows through a URL
Want to demonstrate
A concrete repro: as user A, modify or read user B's data.
--- *This is NOT a normal bounty. Do not post a public PoC or a public PR demonstrating the vulnerability. Submit findings via the bug-report form at https://score.irregulars.io/contribute#report-bug, or email security@irregularchat.com, or DM an admin on Signal. Awards are admin-determined based on impact: low=50 / medium=150 / high=300 / critical=500 / rce=750.*
Relevant files
No relevant files linked yet.
Hints
No hints yet.
Activity
No points have been awarded for this bounty yet.
Comments
Sign in to join the discussion.
No comments yet. Be the first to weigh in.