# Non Org Admin/Group Manager can create groups in an organization

GraphQL mutation let a Program Admin add themselves to default admin groups, escalating to report manager or full program admin.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: akashhamal0x01
- Disclosed: 2024-07-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2372018
- Library page: https://bugbountylibrary.com/r/h1%3A2372018
- Tags: area:web domain:api domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high tech:graphql vuln:access-control vuln:privilege-escalation

**Target:** GraphQL API group membership mutation
**Root cause:** A GraphQL mutation allowed a low-privileged Program Admin to assign themselves to default admin groups created with a new program, without authorization checks on group membership.
**Steps:**
1. As a user with only Program Admin permissions, invoke the GraphQL mutation that adds a user to a group, targeting the default admin group of the program.
2. Assign your own account to that default admin group.
3. Observe elevated permissions such as modifying reports, awarding bounties, and managing users/groups.
4. If an org admin later edits the default admin group's permissions, re-assign the group to yourself to inherit the new elevated permissions.
**Exploitation:** A Program Admin uses the GraphQL group-membership mutation to add themselves to the program's default admin group, inheriting that group's permissions and gaining report management, bounty awarding, and user/group management capabilities.
**Escalation:** Re-assigning the default admin group after an org admin modifies its permissions lets the attacker inherit newly elevated permissions, potentially reaching full program administrative control.
**Insight:** When a new program is provisioned, default admin groups are auto-created; test whether group-membership mutations enforce authorization on those default groups rather than only on custom groups.