First, I looked for an authentication bypass but found nothing, so I shifted my focus to privilege escalation.

Steps to Reproduce

  1. Log in as Admin → invite a new user with Viewer role
  2. "Accept invitation" → complete sign-up
  3. Confirm the new account shows Viewer role and cannot see admin details
  4. open developer tool and copy the authorization token from local storage
  5. Execute the curl command with the viewer token
  6. Observed Result, The API returns full admin profile data, including sensitive phone no
None
curl cmd

Usually, this kind of bug isn't critical, but it keeps your motivation up