# Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed.

Restricted Algolia team members could extract an application-wide signature from the dashboard page source and use it against /1/admin/* endpoints to dump all indexes and full query/response logs, even after removal.

- Payout: $400
- Severity: high
- Program: Algolia
- Credited: eboda
- Disclosed: 2016-11-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/156520
- Library page: https://bugbountylibrary.com/r/h1%3A156520
- Tags: domain:api domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Algolia /1/admin/* REST endpoints (listIndexes, userlogs, stats)
**Root cause:** The dashboard embeds an application-specific signature that authorizes /1/admin/* calls, but it is not scoped to the user's role or index permissions and is not invalidated on member removal or API key rotation.
**Steps:**
1. Invite a team member with only Search rights scoped to one index (e.g. `test`).
2. Log in as that member; dashboard shows 'You don't have access to the Algolia Dashboard.'
3. View page source and copy the `signature` value.
4. POST to `https://c5-eu-1.algolianet.com/1/admin/listindexes` with `{"applicationID":"APP_ID","signature":"SIG","page":0,"sortByNbEntries":1}` to list all indexes.
5. POST to `/1/admin/userlogs` with `{"applicationID":"APP_ID","signature":"SIG","offset":0,"length":1000,"type":"all"}` to dump full request/response bodies of all past queries.
6. Optionally hit `/1/admin/stats/INDEXNAME` for per-index stats.
**How found:** Noticed the dashboard denied access but still rendered a `signature` in page source; hypothesized it authorized admin endpoints independently of the user's API key and tested /1/admin/listindexes and /1/admin/userlogs.
**Exploitation:** A low-privilege or removed team member reads the signature from the dashboard HTML, then replays it in JSON bodies to /1/admin/* endpoints, bypassing API-key scoping to enumerate indexes and exfiltrate full query/response logs including record contents and API keys in logged URLs.
**Escalation:** Signature is application-wide and persists after member removal and admin API key regeneration, granting indefinite access; userlogs also leak API keys embedded in logged request URLs.
**Insight:** When a UI blocks a user but still ships a token/signature in the page, test that token directly against the backing admin API — and check whether it is scoped to the user or just to the application, since app-scoped tokens survive revocation.