# Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/

IDOR in TaxJar's Accountant Access form let an attacker change any account's email via manipulated account number, enabling mass account takeover.

- Payout: hidden
- Severity: high
- Program: Stripe
- Found by: mr_asg
- Disclosed: 2022-10-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1685970
- Library page: https://bugbountylibrary.com/r/h1%3A1685970
- Tags: area:web domain:web impact:ato impact:mass-exploit kind:bounty platform:hackerone sev:high technique:source-review vuln:access-control vuln:account-takeover vuln:idor

**Target:** app.taxjar.com /accounts/<ACCOUNT_NUMBER> POST endpoint
**Root cause:** The email-change endpoint trusted the account ID in the URL instead of validating that the reset token/user context matched the target account, allowing arbitrary account email modification.
**Steps:**
1. Authenticate to app.taxjar.com as attacker
2. Send POST to `/accounts/<victim_ACCOUNT_NUMBER>` with payload including `email=<attacker_email>`
3. Server updates victim account email to attacker's address
4. Trigger password reset to attacker email to take over account
5. Loop over account numbers with a Python script to mass-takeover accounts
**How found:** Researcher noticed the Accountant Access form accepted an account number in the URL and an email parameter in the body, hypothesizing the server would trust the URL ID without binding it to the authenticated user.
**Exploitation:** Attacker iterates account numbers in the POST request, replacing each victim's email with their own, then uses password reset to gain control of each account at scale.
**Escalation:** Automated loop over sequential account numbers to mass-takeover many accounts.
**Insight:** On multi-tenant SaaS, test whether email/identity-change endpoints bind the target object ID in the URL to the authenticated session or reset token; sequential account numbers plus a body email param are a classic IDOR-to-ATO pattern.