Access-Control

2 articles

Unauthenticated Admin API Access via HTTP Verb Tampering

Wayback Machine recon led to hidden admin endpoints. A simple switch from GET to POST bypassed all access controls, leaking thousands of customer records from a REACTED promotion campaign.

3 Feb 2026 · 3 min read

Writeups

Premium Feature Bypass via PATCH Request

While editing a post, I noticed the imageUrls parameter was already in the request body — empty. Non-premium users shouldn't be able to set it, but the API accepted it without checking.

13 Jun 2025 · 3 min read