# Insufficient access control on all BCRM instances leading to the ability to create admin accounts using the API

Insufficient access control on BCRM's /admins API let an attacker create internal-only super-admin accounts on any LINE Official Account instance.

- Payout: hidden
- Severity: high
- Program: LY Corporation
- Found by: j0eii
- Disclosed: 2020-08-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/836081
- Library page: https://bugbountylibrary.com/r/h1%3A836081
- Tags: area:web domain:api impact:internal-access impact:privesc kind:bounty platform:hackerone sev:high vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** BCRM /admins REST API endpoint
**Root cause:** The /admins endpoint, publicly reachable so customers can invite admins, lacked checks distinguishing customer-admin creation from internal super-admin creation, allowing the privileged role to be requested directly.
**Steps:**
1. Identify BCRM instance and its public /admins API endpoint
2. Send a request to /admins creating a new admin account, specifying the super-admin role
3. Observe the account is created with internal-only super-admin privileges
**Exploitation:** Attacker calls the public /admins endpoint to create a super-admin account, gaining internal-level administrative access to the BCRM instance.
**Insight:** When an endpoint is public to support customer self-service (inviting admins), test whether privileged role fields or internal-only account types can be passed directly in the same request.