# Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.

Duplicate invitations with different roles let an admin keep a hidden admin membership invisible to the owner, retaining user invite/remove powers after removal.

- Payout: hidden
- Severity: high
- Program: Reddit
- Found by: 41bin
- Disclosed: 2022-11-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1596663
- Library page: https://bugbountylibrary.com/r/h1%3A1596663
- Tags: area:web domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high technique:chained vuln:access-control vuln:business-logic

**Target:** ads.reddit.com organization role/invitation API
**Root cause:** Accepting multiple invitations for the same email with different roles creates a second membership record; removing one role leaves the other active but hidden from the members list.
**Steps:**
1. Login as admin, go to /account/<id>/permissions and invite user with role `admin`
2. Accept invite as that user in another browser
3. Invite same email again with role `Analyst`
4. Accept the Analyst invite at https://ads.reddit.com/accounts
5. Capture the Authorization token from the malicious account's billing requests in Burp
6. As admin, set the malicious account's permission to `None` to remove it
7. Replay `POST /api/v2.0/accounts/<id>/invitations` with the captured token and body `{"data":{"recipient_email":"<email>","type":"ADMIN"}}`
8. Observe the removed user can still invite users to the organization
**How found:** While testing role management, noticed the same email could be invited multiple times to one org when assigned different roles, then hypothesized a stale membership would persist after removal.
**Exploitation:** Attacker with admin role creates a duplicate membership via a second lower-role invite, then retains the captured auth token after being removed, allowing continued invite/remove actions on the org despite no longer appearing in members.
**Escalation:** Persistent hidden admin access survives owner removal, enabling ongoing user management and org manipulation.
**Insight:** When an app allows multiple invitations per email with differing roles, test whether each acceptance creates a separate membership record and whether removing one role revokes the token/access of the others.