# The Unexpected “0” Master ID for Account Data Manipulation

Setting id=0 with blank uuid in a profile-update POST let an attacker modify any user's account data by email, a broken access control master-ID flaw.

- Payout: $2,500
- Severity: high
- Program: -
- Credited: YoKo Kho
- Disclosed: 2023-06-19
- Write-up quality: 6/10
- Original: http://www.firstsight.me/2023/06/the-unexpected-0-master-id-for-account-data-manipulation/
- Library page: https://bugbountylibrary.com/r/blog%3Afirstsight-me-2023-06-the-unexpected-0-master-id-for-account-data-manipulation
- Tags: domain:api domain:web impact:integrity kind:bounty platform:blog sev:high technique:param-pollution vuln:access-control vuln:business-logic vuln:idor

**Target:** Account data update API endpoint (POST)
**Root cause:** The update endpoint trusted a client-supplied id parameter; id=0 was treated as a master/wildcard ID matching all accounts, and the uuid check was bypassed when left blank.
**Steps:**
1. Capture the profile-update POST: `id=<n>&uuid=<uuid>&email=<email>&Parameter1=...`
2. Set `id=0`, leave `uuid=` empty, set `email=<victim>`
3. Send request with attacker session; victim's data is modified
**How found:** Noticed the app began using a previously-abandoned undocumented API for updates. Tried ID swap, UUID/email swap, deleting ID+UUID, and method change—all failed. Then tried id=0 with blank uuid, which unexpectedly succeeded.
**Exploitation:** Attacker with any authenticated session sends the update POST with id=0, empty uuid, and the victim's email, causing the server to apply attacker-chosen data values to the victim's account.
**Insight:** When an endpoint carries redundant identity fields (id, uuid, email), try sentinel values like 0, -1, or empty for each field independently—developers sometimes implement a 'master' or wildcard ID for admin/internal use that bypasses ownership checks.