# Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpoint

Read-only org member could delete any higher-privileged member's membership via unauthenticated DELETE /api/memberships/<id>, kicking admins/owners out.

- Payout: hidden
- Severity: medium
- Program: Helium
- Found by: chipped
- Disclosed: 2020-06-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/810320
- Library page: https://bugbountylibrary.com/r/h1%3A810320
- Tags: area:web domain:api impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:graphql tech:rest vuln:access-control vuln:idor vuln:privilege-escalation

**Target:** REST endpoint /api/memberships/<membershipID> on console.helium.com
**Root cause:** The DELETE /api/memberships/<membershipID> endpoint lacks authorization checks tying the membership ID to the caller's org/role, so any member can delete arbitrary memberships by ID.
**Steps:**
1. Create user1 (admin) and user2 (read-only) in an org; add user2 via Users > Add User with read-only perms.
2. Log in as user2, switch to user1's org, intercept traffic.
3. Trigger PaginatedMembershipsQuery GraphQL request to list memberships and capture user1's membership `id`.
4. Switch user2 back to their own org, add user1 to it, then delete user1 from the list while intercepting.
5. Send `DELETE /api/memberships/<id>` to repeater and replace the id with user1's stored membership id.
6. Refresh user1's page: they are logged out with 401 'You don't have access to this organization'.
**How found:** Noticed the memberships DELETE endpoint accepted arbitrary membership IDs without role checks while proxying GraphQL membership listings.
**Exploitation:** A read-only member enumerates membership IDs via GraphQL, then issues DELETE /api/memberships/<victimID> to remove admins/owners from their org, locking them out.
**Escalation:** Managers can remove administrators, leaving the attacker unsupervised control over the org.
**Insight:** GraphQL listing queries leak object IDs that REST mutation endpoints may not re-authorize against; test cross-org ID substitution on DELETE/PUT endpoints.