Description

Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-31T21:17:51.047Z",
  "pubdate": "2026-08-31T21:17:51.047Z",
  "executiveSummary": "A broken access control vulnerability exists within the OwnerRez API in versions 1.2.6 and earlier.\nThis vulnerability allows authenticated users with limited 'Subscriber' privileges to access, modify, or perform unauthorized operations on data that should be restricted to higher-privileged users or owners.\nThe flaw stems from insufficient server-side authorization checks on API endpoints, failing to properly validate if the requesting user possesses the necessary permissions to access the target resource.\nSuccessful exploitation allows an attacker with low-level subscriber credentials to bypass security controls and interact with unauthorized API functions, potentially leading to unauthorized data exposure, data manipulation, or unauthorized administrative actions.\nThe risk implication is significant as it undermines the principle of least privilege, enabling vertical and horizontal privilege escalation depending on the exposed endpoints.\nExploitation requires an active, authenticated subscriber account, but no special administrative privileges or complex preconditions.",
  "technicalDetails": "The root cause of this vulnerability is improper authorization validation within the OwnerRez API component, specifically affecting versions 1.2.6 and earlier.\nWhile the API properly handles authentication (verifying the identity of the user), it fails to adequately perform authorization checks (verifying if the identified user is permitted to perform the requested action) for various API endpoints.\nThe vulnerability manifests because the API relies on client-provided identifiers or lacks explicit checks comparing the authenticated user's session scope against the requested resource's ownership or permission requirements.\nAn attacker can exploit this by manipulating API requests—such as modifying request parameters (e.g., IDs in URLs or JSON bodies) or calling restricted API endpoints directly—while authenticated as a subscriber.\nAttack flow: 1. The attacker authenticates as a legitimate Subscriber user to obtain a valid session token or API key. 2. The attacker identifies or enumerates API endpoints intended for privileged users (e.g., property managers or owners). 3. The attacker crafts HTTP requests targeting these restricted endpoints. 4. Because the server fails to validate the user's role against the target resource, the API processes the request as if it originated from a privileged user.\nThis flaw allows for unauthorized access to sensitive data objects, potentially enabling an attacker to read private property configurations, guest information, or booking details, or to execute administrative mutations that the subscriber should not be authorized to initiate.\nThe vulnerability is exposed over the network, as the API endpoints are reachable by the authenticated user base. Post-exploitation impact includes information disclosure, unauthorized data modification, and potential business logic abuse, depending on which endpoints are improperly secured."
}