# Team member with Program permission only can escalate to Admin permission

A team member with only Program permission could reach the groups endpoint and grant themselves Admin, Reward and Report permissions.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: metnew
- Disclosed: 2019-06-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/605720
- Library page: https://bugbountylibrary.com/r/h1%3A605720
- Tags: area:web domain:web impact:data-leak impact:privesc kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:idor vuln:privilege-escalation

**Target:** Team group management endpoint (hackerone.com/TEAM/groups)
**Root cause:** The groups management endpoint lacked server-side authorization checks, so members with only Program permission could modify group permissions despite the Group/User Management menus being hidden.
**Steps:**
1. Log in as a user assigned to a group with Program permission.
2. Navigate to `https://hackerone.com/TEAM/groups`.
3. Select the current user's group.
4. Add an arbitrary permission (e.g. Admin) to the group.
**How found:** Noticed the groups URL was reachable even though Group Management and User Management menus were hidden, then tried adding a permission to their own group.
**Exploitation:** A Program-permission member directly accessed the groups page and added Admin (and thus Reward/Report) permissions to their own group, escalating privileges within the team.
**Escalation:** Escalating to Admin also granted Reward and Report permissions, expanding control over the program.
**Insight:** When UI menus are hidden by permission, test the underlying routes directly; hidden navigation is not authorization. Also compare sibling JSON endpoints (teams.json vs TEAM/groups.json) for inconsistent access thresholds.