# IDOR when moving contents at CrowdSignal

IDOR in CrowdSignal's move-content action lets an attacker swap sequential content IDs to take over other users' content, fully via a team account.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: bugra
- Disclosed: 2020-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/915127
- Library page: https://bugbountylibrary.com/r/h1%3A915127
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:param-pollution vuln:access-control vuln:idor

**Target:** POST /dashboard actionable[] parameter (content move)
**Root cause:** The move-content endpoint trusts the client-supplied actionable[] content ID without verifying ownership, and IDs are sequential.
**Steps:**
1. Go to https://app.crowdsignal.com/dashboard and select a content checkbox with Burp intercept on
2. Click `Move to > My Content`, intercept POST to `/dashboard`
3. Replace `actionable[]` value with victim's content ID
4. For full takeover: add a second email at /users/list-users.php and confirm
5. Select content, `Move to > Move to another user`, pick second account
6. Swap `actionable[]` with victim's content ID, then check second account dashboard
**How found:** Observed the actionable[] parameter carried the content ID during a move request and tested substituting another ID, then found the team 'Move to another user' flow gave full access.
**Exploitation:** Attacker submits victim's sequential content ID in the move request; with a team account the content is transferred into the attacker's secondary account, granting full control.
**Escalation:** Free account only changes status; adding a team member account escalates to full content takeover.
**Insight:** When a move/transfer action takes an object ID, test it in every transfer destination variant (self vs another user) — the more privileged flow often skips the ownership check the basic one enforces.