Member-only story
921$ Privilege Escalation: Unauthorized User Addition to Shared APP Connections
This article is about a bug which i founded in nov. of last year which allow an low level and unauthorized user to add a new user in shared app connection which give access to confidential data to unwanted user and affecting the integrity of the platform.

Understanding Target
Exapier, a platform that facilitates easy automation, connects various apps to automate workflows. Shared app connections, such as those with Google Drive, are pivotal for collaborative and efficient operations.
Bug Discovery
A flaw in Exapier’s access control allows low-level users to manipulate shared connections. Unauthorized additions to connections like Google Drive pose a significant security risk, breaching expected permissions.
Before we move on, if you like my write-ups, please support me by clapping, sharing, and you can clap up to 50 times here on Medium, it’s free. Thank you.
Steps to Reproduce:
- Firstly the Admin added the low level user into shared app(google drive) connection. Capture this request of adding the user for later use.