I am testing an app and I found a link in source code that permit me to access a document without authenticating to the application on which that document is present.

The url has a key in the get and it is that key that allows me to access that resource without authenticating

I can classify it as "Broken access control: : unauthenticated access "?

  • 1
    why not direct object reference?
    – schroeder
    Sep 20 at 22:24
  • 2
    Is this desired functionality of the system? It very well could be exactly what is intended and desired. Being able to generate a link that unauthenticated users can use to access specific resources is a valid use case for some systems. Sep 20 at 23:25
  • in practice, in the source code I found a preconfigured email in which there is a link that, if pressed, allows those who will receive this email to access their (recipient's) profile. then whoever receives it will be able to access the document and access his profile without logging in. furthermore, always in the email, there are also the credentials of the user to whom the email is addressed. with what severity should this be reported? do you consider it an information disclosure?
    – moskino11
    Sep 22 at 9:37
  • 1
    @schroeder you are definitely right. This problem falls precisely in this case, thank you very much.
    – moskino11
    Sep 23 at 15:28


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.