Infosec · field notes

Writeups, research & notes from the field.

Bug bounty writeups, API recon, and other notes from the field. Plain and technical, with no fluff.

entity authorization bypass: the debug page that got left in prod
2026-08-30 Critical · CVSS 9.3

An unauthenticated debug page in a vet PMS prefilled itself with live entity IDs and a verification salt. Identity to entity-level access, no auth required.

writeup authz IDOR PMS debug
Read the writeup →