# Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access

Dev-role App Search user with Limited Engine Access could still hit /api/as/v1/credentials/ and read all API keys, including the default private key with read/write to all engines.

- Payout: hidden
- Severity: high
- Program: Elastic
- Found by: superman85
- Disclosed: 2021-08-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1218680
- Library page: https://bugbountylibrary.com/r/h1%3A1218680
- Tags: area:web3 domain:api impact:data-leak impact:privesc kind:bounty platform:hackerone sev:high tech:rest technique:incomplete-fix vuln:access-control vuln:auth-bypass vuln:privilege-escalation vuln:secrets-leak

**Target:** App Search REST API endpoint /api/as/v1/credentials/
**Root cause:** The credentials listing endpoint lacked a role/engine-scope authorization check, so any authenticated App Search user (including Dev with Limited Engine Access and no engines assigned) could enumerate all API keys.
**Steps:**
1. Create Kibana user `dev` with a password and role via /app/management/security/users/
2. As admin in App Search, go to /as#/role-mappings/ and Add mapping: External Attribute `username`, value `dev`, Role `Dev`, Engine Access `Limited Engine Access` (no engines selected)
3. Log in to App Search as `dev`
4. Request `GET https://your_app_search_instance/api/as/v1/credentials/`
5. Observe response returns all API keys (private-key, search-key, etc.)
**How found:** After a prior related report (#1168528) was fixed, the researcher re-tested other roles and hypothesized the same credentials endpoint was still reachable for the Dev role with Limited Engine Access, then confirmed by direct request.
**Exploitation:** Attacker with a low-privileged Dev account reads the default Private API Key (read/write to all engines) or a pre-existing Private Admin Key from the credentials listing, then uses it to create new API keys or delete existing ones, escalating to full engine control.
**Escalation:** Chained the leaked default/pre-existing private key to mint or delete API keys, converting limited engine access into full read/write across all engines.
**Insight:** When a fix lands for one role on an authorization bug, re-test the same endpoint across every other role/scope combination — role-mapping features (external attribute mappings) often leave sibling roles unguarded.