How Chained Broken Access Control Flaws Can Lead to Account Takeover

Summary

NahamSec explains how separate low-severity access-control flaws—exposing a user ID, enabling email changes and facilitating password reset—can be chained into account takeover, and urges researchers to map permissions and report the chain.

Key points

• Broken access control occurs when users can access data or actions beyond their permitted roles.
• A disclosed user ID may enable access to an endpoint intended for another user.
• If that endpoint allows an email change, the flaws may be chained to reset the account password and take over the account.
• NahamSec advises mapping what each role can do and reporting related flaws as a chain rather than in isolation.
• The speaker says this bug class has earned over $30,000 through a bug bounty program.