# fabric.io - app member can make himself an admin

A team member on Fabric could PUT {"admin":true} to their own account endpoint, escalating to admin and gaining control over all team users.

- Payout: $1,400
- Severity: high
- Program: X / xAI
- Credited: satishb3
- Disclosed: 2015-03-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/42961
- Library page: https://bugbountylibrary.com/r/h1%3A42961
- Tags: domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:privilege-escalation

**Target:** Account settings API endpoint (/accounts/{id})
**Root cause:** The account update endpoint accepted an 'admin' field from the user's own request without verifying the caller had permission to grant admin, allowing mass-assignment of a privileged attribute.
**Steps:**
1. Log in as member Alice, open TestApp team members; GET `/api/v2/organizations/[orgid]/apps/[appid]/team_members` returns Alice's `id` and `is_admin:false`.
2. Send `PUT /accounts/54aa4ab19ea6961359001260` with `Content-Type: application/json; charset=UTF-8`, valid `X-CSRF-Token` and `X-CRASHLYTICS-DEVELOPER-TOKEN`, body `{"admin":true}`.
3. Refresh team members page; Alice's role now shows Admin and she can modify/delete other team users.
**How found:** Researcher noticed the team_members response exposed the user id and is_admin flag, then tested whether the account update endpoint would accept an admin field on their own record.
**Exploitation:** Authenticated low-privilege member reads their own user id from the team_members API response, then issues a self-targeted PUT to /accounts/{id} with JSON body {"admin":true} and required CSRF/developer-token headers, flipping is_admin to true and gaining admin control over the team.
**Escalation:** Admin role lets the attacker change or delete all other team members, taking over the app's team.
**Insight:** When an API response exposes your own object id alongside a privileged boolean (is_admin), try mass-assigning that boolean via the object's update endpoint; JSON content-type often bypasses form-only field filtering.