# IDOR when editing email leads to Account Takeover on Atavist

IDOR in Atavist account email-change endpoint lets an attacker swap any user's email via sequential IDs, then reset password for account takeover.

- Payout: hidden
- Severity: critical
- Program: Automattic
- Found by: bugra
- Disclosed: 2020-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/950881
- Library page: https://bugbountylibrary.com/r/h1%3A950881
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:critical technique:source-review vuln:account-takeover vuln:idor

**Target:** Account settings email-change endpoint (/cms/reader/account)
**Root cause:** The email-update request trusts a client-supplied sequential `id` parameter to select the account, without verifying it matches the authenticated user.
**Steps:**
1. Log in at `https://magazine.atavist.com/login`
2. Open `https://magazine.atavist.com/cms/reader/account` with a proxy
3. Change email and click Save, capture the request
4. Modify the `id` parameter to the victim's user ID (sequential)
5. Forward the request to change the victim's email
6. Trigger password reset at `https://magazine.atavist.com/forgot` to take over the account
**How found:** Researcher inspected their own settings-page request, noticed a user-ID `id` parameter in the body, and hypothesized it was not bound to the session.
**Exploitation:** Attacker authenticates with own account, intercepts the email-change request, substitutes the victim's sequential user ID, and updates the victim's email to one they control. They then use the forgot-password flow to reset the victim's password and log in.
**Escalation:** Sequential user IDs allow mass takeover of all accounts by iterating IDs.
**Insight:** On account-settings endpoints, watch for a client-supplied user identifier in the body even when the session already identifies the user; sequential IDs make it mass-exploitable via the password-reset flow.