Loading story…
A vulnerability assessment of OWASP Juice Shop identified four major application security flaws, including a critical privilege escalation issue that lets unauthenticated users create administrator accounts through the /api/Users registration endpoint by supplying a role parameter. The report also described an OAuth account takeover weakness in which passwords for Google-linked accounts could be derived from reversed, Base64-encoded email addresses, enabling attackers to access victim accounts without authorization. Both issues map closely to OWASP Top 10 risks around Broken Access Control and Identification and Authentication Failures, as well as CWE-269 Improper Privilege Management.
See affected versions and whether adversaries are exploiting it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security researchers have documented the discovery and exploitation of critical vulnerabilities in web applications that can lead to full account takeover, data leakage, and privilege escalation. One researcher identified a business logic flaw involving inconsistent validation between client-side and server-side checks, which allowed unauthorized access to premium account features without payment. Another case involved a password change functionality that, due to improper implementation, enabled attackers to compromise user accounts entirely, with a CVSS score of 8.3 highlighting its severity. Blind XSS vulnerabilities were also reported, where payloads injected into user-facing forms were later triggered in privileged internal dashboards, resulting in session hijacking and potential compromise of sensitive systems. A critical OAuth misconfiguration was found, where manipulation of the redirect_uri parameter enabled attackers to steal JWT tokens, granting them unauthorized access to user accounts. Misconfigured Cross-Origin Resource Sharing (CORS) headers were exploited to escalate privileges, allowing attackers to become administrators and exfiltrate sensitive data across domains. Another researcher demonstrated how error messages and exposed API endpoints could be leveraged to enumerate and access sensitive backend systems, increasing the attack surface. The exposure and leakage of JWT tokens in server responses were shown to facilitate privilege escalation and impersonation of any user on the platform. Cache poisoning attacks against CDN infrastructure were also detailed, where improper cache key handling resulted in users receiving cached responses containing other users' private data, leading to widespread session hijacking. These incidents underscore the importance of secure implementation of authentication, authorization, and session management mechanisms. The vulnerabilities described were discovered through a combination of manual testing, creative payload injection, and analysis of application logic rather than automated scanning. Proof-of-concept exploits were provided for several of the vulnerabilities, demonstrating the ease with which attackers could compromise accounts or escalate privileges. The affected applications often failed to implement proper input validation, secure token handling, and least-privilege access controls. In several cases, the vulnerabilities were reported responsibly to the affected organizations, resulting in remediation and, in some instances, significant bug bounty rewards. The reports highlight the ongoing risk posed by business logic flaws, misconfigurations, and insufficient security controls in modern web applications. Security teams are advised to conduct thorough code reviews, implement robust validation on both client and server sides, and regularly audit authentication and authorization flows. The findings also emphasize the need for continuous monitoring and testing of production systems to detect and remediate such vulnerabilities before they can be exploited by malicious actors. Overall, these real-world cases provide actionable insights for organizations seeking to strengthen their web application security posture.
Jul 12, 2026
Security researchers uncovered significant vulnerabilities in web applications due to broken access control mechanisms, leading to unauthorized privilege escalation and potential system compromise. In one case, a researcher discovered that a SaaS platform inadvertently exposed administrative functionalities to regular users. By simply signing up for a free trial, the user noticed an admin panel link was visible, which should not have been accessible to non-privileged accounts. Initial attempts to access the admin panel resulted in a 403 Forbidden error, but further probing revealed that the access control checks were insufficiently enforced. Through a series of advanced techniques, the researcher was able to escalate privileges, ultimately gaining access to sensitive administrative features and potentially compromising the entire system. This highlights the critical risk posed by misconfigured or broken permission models in enterprise SaaS environments, where a single oversight can grant attackers broad access to internal resources. In a separate incident, a security tester examining a hospital website identified two PHP endpoints protected by 403 Forbidden responses. Despite the initial access denial, the tester experimented with different HTTP methods and payloads, eventually bypassing the restriction by switching from a GET to a POST request and supplying the required form data. The server processed the request as if it were legitimate, exposing a workflow flaw that could allow unauthorized users to submit sensitive information or interact with backend systems. The tester replicated this technique on another endpoint, confirming that the access control logic was consistently weak across multiple parts of the application. Both incidents underscore the prevalence of insecure direct object references and improper authorization checks in modern web applications. Attackers can exploit these weaknesses to move laterally within systems, access confidential data, or disrupt critical workflows. The findings demonstrate the importance of rigorous access control validation, including proper segregation of user roles and comprehensive testing of all endpoints for privilege escalation vectors. Organizations are urged to review their authentication and authorization mechanisms, implement least privilege principles, and conduct regular security assessments to identify and remediate such vulnerabilities before they can be exploited. These real-world examples serve as a cautionary tale for developers and security teams, emphasizing that even seemingly minor oversights in access control can have far-reaching consequences for data security and operational integrity.
Jul 12, 2026
OWASP's **API Security Top 10** identifies broken object-level and function-level authorization, excessive data exposure, security misconfiguration, and unsafe trust boundaries as leading API risks, warning that business logic abuse and operational gaps often turn ordinary endpoints into high-impact exposures. Those patterns were reflected in newly disclosed incidents involving both enterprise software and consumer-facing platforms, where low-privileged access was enough to reach data and functions intended for administrators or other users. In **CVE-2026-46515**, Frogman versions before `1.6.3` allowed users with only `PERM_READ` privileges to access administrative PBX data through MCP and HTTP APIs, including AMI manager secrets, outbound dial PINs, SIP secrets, backup paths, CDR history, and even root SSH connection commands; the flaw also enabled arbitrary execution of saved GraphQL queries and was rated **CVSS 9.3**. Separately, a bug bounty report on Target's Academy platform showed how two seemingly low-risk APIs could be chained to enumerate users and expose PII at scale, underscoring how weak authorization controls across interconnected endpoints can escalate routine API functionality into serious data disclosure.
Jul 19, 2026