IDOR in VinceComm Vendor Admin Panel

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in a view function called ModifyEmailNotifications. It allows a vendor admin to modify email notification settings or view email details for contacts belonging to other vendors by manipulating the record's primary key in the URL without proper authorization checks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is an Insecure Direct Object Reference (IDOR) in a Python application. To detect it, inspect the vinny/views.py file for the ModifyEmailNotifications view. Check if it fetches VinceCommEmail by raw primary key from the URL without verifying the record's contact belongs to the requesting group-admin. Look for improper access control checks in the toggle logic for email_function/name.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access or alter email notifications and settings for contacts they do not own. This could lead to unauthorized access to sensitive communications, data leaks, or disruption of legitimate notification services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by enabling unauthorized access to personal or sensitive information. It may lead to non-compliance with privacy principles such as data minimization, access control, and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately review and update the ModifyEmailNotifications view in vinny/views.py to enforce proper access control. Ensure the record's contact belongs to the requesting group-admin before allowing any modifications to email_function/name. Implement server-side validation to prevent unauthorized access to other vendors' contacts.

Useful 0 Not Useful 0