Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.
访问控制 / 访问控制缺陷（通用） / #1596663
该报告还没有中文解读。
原文摘录
摘自原文（3953 字符中的一小部分）
ads.reddit.com is an ads creating and managing application for reddit. The application has the feature to invite other members to the organization and give different roles at ad management. Testing around the role management functionalities, I have noticed that a user with the same email can get …
原文中的代码
I know creating an owner account and then creating an admin account with in a limited time is little-bit painful.
You can use the following credentials to login as admin
email :██████████
name: ███████
password : ██████████默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Reddit 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @41bin · 版权归作者与 Reddit 所有