Fabric.io - an app admin can delete team members from other user apps #43065 Valid X / xAI Access Control – 2015-03-09 $1,120 3 Team admin can change unauthorized team setting (require_at_for_mention) #46747 Valid Slack Access Control – 2015-04-30 $200 3 Team admin can change unauthorized team setting (allow_message_deletion) #46750 Valid Slack Access Control – 2015-05-30 $100 3 Team admin can add billing contacts #47940 Valid Slack Access Control – 2015-04-03 $200 3 A 'Full access' administrator is able to see the shop owners user details #96890 Valid Shopify Access Control – 2015-11-10 $500 3 Shop admin can change external login services #56626 Valid Shopify Access Control – 2015-10-02 $1,000 5 Tables application does not respect sharing limitations set by admin #3642236 Valid Nextcloud Access Control Medium 2026-10-27 – 6 Staff members with no permission can access to the files, uploaded by the administrator #97452 Valid Shopify Access Control – 2016-07-07 $500 7 Stocky App Administrator can create a backdoor admin account by using an existing POS User #962895 Valid Shopify No weakness recorded – 2020-08-24 – 8 Group admin can remove user from all his groups via API #199286 Valid Nextcloud No weakness recorded None 2017-02-23 – 10 Administrator can create user without entering high security mode #351361 Valid Phabricator Authentication Low 2018-05-22 – 11 [AWC-Pune] - User can download files deleted by Admin using shortcuts #1463028 Valid Lark Technologies No weakness recorded Medium 2022-02-25 – 11 [Привязка email к странице] by admin@notify.vk.com | email-flood #344223 Valid VK.com No weakness recorded None 2018-06-16 – 13 Stored XSS in Macro Editing - Introduced by Admins to affect Admins #471660 No longer public Zendesk Cross-site Scripting – 2019-07-27 – 27 An organization admin can create an attacker-controlled organization owner via the gem transfer flow Analysed #3938927 Valid RubyGems Access Control High 2026-10-15 – 27 Read-only administrator can change agent update settings Analysed #1538004 Valid Acronis Access Control Medium 2022-08-10 $200 29 Admins can change authentication details of user configured external storage Analysed #2107934 Valid Nextcloud Access Control Low 2023-12-21 $100 31 Group admins can remove arbitrary data from "data" directory (including admin data) Analysed #508493 Valid Nextcloud Access Control High 2019-08-12 – 32 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups Analysed #3674940 Valid Nextcloud Access Control Medium 2026-09-17 – 36 [h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribe Analysed #1084865 Valid Shopify Access Control Low 2024-01-17 – 51 A malicious admin can be able to permanently disable a Owner(Admin) to access his account Analysed #1718574 Valid Linktree Insecure Direct Object Reference Medium 2022-10-25 $600 55 Non-store owners can transfer Shopify-managed domain to another domain provider Analysed #1820953 Valid Shopify Access Control Medium 2024-01-17 – 58 Privilege escalation - Support-Contributor to Support and Product Admin via `/api/v2/██████` . No ADMIN PRIVILEGE required. #2188569 No longer public Zendesk Access Control – 2023-12-18 – 58 Program admins could add verified domains to an organization Analysed #2323303 Valid HackerOne Access Control Low 2024-03-07 – 83 Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application. Analysed #1596663 Valid Reddit Access Control High 2022-11-14 – 186