# IDOR in API applications (able to see any API token, leads to account takeover)

IDOR in Pressable's API application update endpoint leaked any app's Client ID and Secret, enabling full account takeover via the API.

- Payout: hidden
- Severity: critical
- Program: Automattic
- Found by: bugra
- Disclosed: 2022-11-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1695454
- Library page: https://bugbountylibrary.com/r/h1%3A1695454
- Tags: area:web3 domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical tech:rest technique:source-review vuln:access-control vuln:idor

**Target:** POST /api/applications update endpoint on my.pressable.com
**Root cause:** The update endpoint trusts the client-supplied application[id] without verifying ownership, and on validation error renders the referenced application's page including Client ID and Client Secret.
**Steps:**
1. Create an API app at https://my.pressable.com/api/applications
2. Open the app, enable proxy, click Update to capture POST /api/applications
3. Change `application%5Bid%5D` to the victim app ID and remove all params except `application%5Bid%5D` and `authenticity_token`
4. Send request; error 'Name must be provided' renders victim app page with Client ID and Client Secret
5. Use leaked credentials against the Pressable API
**How found:** Noticed the application[id] parameter in the update request, changed it to a second account's ID and saw the app move, then hypothesized that error rendering might leak more and stripped all params except id and authenticity_token.
**Exploitation:** Attacker submits a minimal update request with only application[id] and authenticity_token set to a victim's (sequential) app ID; the error response renders the victim's application page exposing Client ID and Client Secret, which are then used to call the Pressable API, including the collaborator bulk-create endpoint, to take over the account.
**Escalation:** Escalated from a low-impact IDOR (moving/removing apps) to credential disclosure by stripping parameters to trigger an error page that renders the target app's secrets; sequential IDs allow enumerating all applications.
**Insight:** When an IDOR only yields a minor effect, try malformed/minimal requests to force validation-error pages that render the referenced object's full detail view — error paths often bypass the authorization that guards the normal view.