Case studies · findings & disclosures

Case studies.

Write-ups of issues I've found and reported - what happened, how I approached it and how it was handled.

• 19 Oct 2026 · 5 min read

  Cross-Tenant BOLA and Unauthorized State Tampering in a Forgotten Fleet Platform

  How an unverified account on an abandoned pre-production fleet portal exposed cross-tenant driver directories, vehicle insurance documents, and enabled arbitrary blacklist tampering.

• 18 Oct 2026 · 4 min read

  Complete Admin Panel Takeover via Self-Issued Administrator Invitations

  How an unprivileged, unverified user session could invoke a privileged onboarding endpoint to generate administrative invitations, achieving full back-office takeover and administrator lockout.

• 17 Oct 2026 · 4 min read

  Host Header Injection to Full HTML Email Spoofing

  How intercepting mobile API traffic revealed an unvalidated X-Forwarded-Host header, enabling arbitrary HTML injection and authentic-looking email spoofing through official communication channels.

• 16 Oct 2026 · 6 min read

  From Frontend Recon to Critical API Flaws in Urban Mobility Platforms

  How analyzing client-side routing bundles and replaying low-privileged session tokens uncovered widespread BFLA, IDOR, and WebSocket authorization flaws across an on-demand mobility platform.

• 16 Oct 2026 · 5 min read

  Mass IDOR via Parameter Tampering & Coordinated Disclosure

  How a client-side boolean flag exposed a platform-wide invoice database of nearly 10,000 records, chaining into widespread IDOR vulnerabilities and a coordinated disclosure mediated by CERT Polska.