# IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignal

IDOR in CrowdSignal's invite-user.php id parameter exposes victim emails and lets an attacker take over any account via Update Permissions.

- Payout: hidden
- Severity: critical
- Program: Automattic
- Found by: bugra
- Disclosed: 2020-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/915114
- Library page: https://bugbountylibrary.com/r/h1%3A915114
- Tags: area:web domain:web impact:ato impact:pii-leak kind:bounty platform:hackerone sev:critical technique:recon vuln:access-control vuln:account-takeover vuln:idor

**Target:** Web endpoint /users/invite-user.php (id parameter)
**Root cause:** The invite-user.php endpoint accepts a user-supplied id and returns/acts on the corresponding user's data without verifying the requester owns or is authorized for that user.
**Steps:**
1. Log in to a CrowdSignal team account.
2. Request `https://app.crowdsignal.com/users/invite-user.php?id=19920465&popup=1` with an arbitrary victim user id.
3. Observe the victim's email in the response.
4. Click `Update Permissions` to be logged into the victim's account.
5. Iterate ids across the sequential range `00010006`–`19920500+`.
**How found:** Noticed the Edit button issues a GET to invite-user.php?id=... and tested changing the id, revealing another user's email and an account-switching action.
**Exploitation:** Attacker enumerates sequential user IDs on the invite-user.php endpoint, reads victim emails, and uses the Update Permissions action to be logged in as the victim, achieving account takeover with no victim interaction.
**Escalation:** Sequential ID range allows mass enumeration and takeover of arbitrary accounts.
**Insight:** Endpoints that render a user-edit popup keyed by a raw id often also carry privileged actions (like 'update permissions') that trust the same id; test the action button, not just the data read.