PentestingHere
Log in Join
[MEDIUM] · Bugcrowd P3 · Unresolved

BOLA Exposes Full Org Data to Access-Only Users

Abdulrahman Zourob Abdulrahman Zourob Web application 16 Aug 2026

The affected asset is anonymised at the researcher's request.

Summary

BOLA in Access Requests allowed users with only Access Requests privileges and no assigned role to access restricted REST API endpoints and retrieve organization-wide sensitive data.

Steps

  1. Log in with an Access Requests–only account.
  2. Capture the authenticated session.
  3. Send direct GET requests to the affected API endpoints.
  4. Endpoints returned 200 OK instead of 403 Forbidden.
  5. Sensitive organization data was exposed.

Impact

  • Enumerate users, emails, IDs, and roles.
  • Identify privileged/admin users.
  • Access teams and agent configurations.
  • Expose request types, approval workflows, and integration data.
  • Leak additional SCIM/user metadata.