# A user with only [MODIFY_SETTINGS] permmision could takeover any user accounts

A user with only modify_settings could repoint SMTP to an attacker-controlled server, capturing password reset links and account credentials sent by admins.

- Payout: hidden
- Severity: low
- Program: PortSwigger Web Security
- Found by: osama-hamad
- Disclosed: 2024-05-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2279010
- Library page: https://bugbountylibrary.com/r/h1%3A2279010
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:low tech:email vuln:access-control vuln:account-takeover vuln:misconfiguration

**Target:** Email/SMTP settings in Burp Suite Enterprise dashboard
**Root cause:** The modify_settings permission allows configuring outbound SMTP, but that capability is not scoped away from sensitive email flows (password reset, user creation) that carry secrets.
**Steps:**
1. Create a user with only Modify settings permission and log in.
2. Navigate to Settings > Email, set SMTP to a public provider (e.g. elasticemail.com) you control, save.
3. Log in as admin, go to Users, trigger reset password for any user.
4. Observe the attacker SMTP dashboard to capture username, email, and reset link.
5. Use the reset link to take over the target account.
**How found:** Noticed that modify_settings, though not granting user/extension management, does grant email configuration; reasoned that outbound mail carrying reset links could be redirected to an attacker-controlled SMTP to harvest secrets.
**Exploitation:** Attacker with modify_settings configures SMTP to an attacker-controlled public mail service. When an admin triggers password reset or user creation, the outgoing email (containing reset link and credentials) is routed through the attacker's SMTP, who reads it from the provider dashboard and uses the link to take over the account.
**Escalation:** Any email-triggering admin action (reset, user add) leaks secrets, enabling takeover of arbitrary accounts including admins.
**Insight:** Permission models often gate direct user management but leave adjacent config (SMTP, webhooks, integrations) writable; any setting that controls where secrets-bearing messages are delivered is effectively an account-takeover primitive.