The /api/shift/adminGetAll endpoint returns administrative shift data when called with a non-admin user token. No role-based check is performed at the handler, and no tenant-membership check either, so the response spans every tenant on the platform. Combined with F-03 this gives a low-privilege attacker a full read of who is running what and when across every tenant, including admin flags on assignees.
Finding 5 of 5 from the GetConnects multi-tenant API assessment. Delivered , published .
POST /api/shift/adminGetAllAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:NTwo failures on one handler. First, there is no role check: an admin-prefixed endpoint is reachable with a non-admin session. Second, there is no tenant scoping: the results are unfiltered across every tenant on the platform. Both look like the same class of "check must happen somewhere else" reasoning that produced F-01 and F-03.
Access to administrative-level operational data across organisations, including campaign scheduling, assignee identities, and admin-flag exposure. The isAdmin field in the response is the specific detail that turns this from an information disclosure into a targeting primitive: an attacker who has already gained low-privilege access on any tenant can now enumerate which named accounts on other tenants carry admin privileges, and use that list as a target set for phishing or credential stuffing.
Combined with F-03, the same low-privilege session pulls a full read of who is running what campaign, when, and under whose admin oversight, for every tenant on the system. That is a materially better position than a full-tenant BOLA on its own, because it maps identities to authority.
isAdmin flag on the session. Endpoints whose URLs advertise administrative intent should fail closed by default and require an explicit opt-in for non-admin access.isAdmin field on non-admin responses. Even if the endpoint were legitimately scoped to a single tenant, echoing role flags on user objects widens the blast radius of any future BOLA on the same endpoint.admin*-prefixed endpoint under a non-admin session and fails the build if any returns a 2xx.Proof-of-concept request:
POST /api/shift/adminGetAll HTTP/2
Host: [REDACTED]
Content-Type: application/json
Cookie: token=<non_admin_user>
{
"json": {
"startFrom": "2026-04-19T14:00:00.000Z",
"endTo": "2026-04-26T13:59:59.999Z"
}
}Response, truncated and redacted:
{
"json": [
{
"organisation": { "name": "[Tenant name redacted]" },
"campaign": { "name": "test" },
"assignee": { "name": "[Redacted]", "isAdmin": true },
"status": "scheduled"
}
]
}admin prefix in the URL is treated as a naming convention rather than an enforcement point.| Date | Event |
|---|---|
| Engagement window; finding delivered on . | |
| Following weeks | Remediation and retest cycle. |
| Public release of redacted writeup. |