Business Logic Bypass Allows Setting “Read Access” Role Without Pro Plan Subscription
该报告还没有中文解读。
原文摘录
摘自原文（2839 字符中的一小部分）
A business logic flaw allows a user with a free plan to generate an invitation link that assigns the Read Access (Read) role, even though this role is intended to be restricted to users with a Pro Plan subscription. By manipulating the invitation creation process, an attacker can create an invite …
原文中的代码
POST /projects/Project-ID/magic-codes HTTP/2 Host: api.lovable.dev Cookie: [Your-Cookie] User-Agent: [] Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://lovable.dev/ Authorization: Bearer [Your-Authorization-Header] Content-Type: application/json …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Lovable VDP 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @ziadmomen · 版权归作者与 Lovable VDP 所有