Summary
A non-founder user can bypass frontend restrictions and disable the “Show Amplenote branding” option on published notes by directly modifying the API request. This feature is intended to be restricted to founder-level accounts only.
Affected Endpoint
PUT /v4/notes/{note_id}
Host: api.amplenote.com
Proof of Concept (PoC)
Step 1: Create & Publish a Note
Create a note using a normal (non-founder) account
Publish the note
Example:
https:
Step 2: Observe Restricted Feature
In note settings:
✅ Show author information → Available
✅ Show view count → Available
❌ Show Amplenote branding → Restricted (Founder-only)
Step 3: Bypass via Developer Tools
Open DevTools
Manually enable the disabled “Show Amplenote branding” toggle in DOM
Step 4: Capture Request
Intercept the request using browser DevTools / proxy when saving changes.
Step 5: Modify & Send Request
Send the following request:
PUT /v4/notes/eb5735a4-3632-11f1-9174-2334d1d0077d HTTP/2
Host: api.amplenote.com
Authorization: Bearer <YOUR_TOKEN>
Content-Type: multipart/form-data
[request body unchanged]
No server-side validation is performed for founder-level restriction.
Step 6: Verify Impact
The request is accepted ✅
“Show Amplenote branding” is successfully disabled ❌
Branding is removed from the published note despite lacking required privileges
Impact
Privilege Escalation: Non-founder users gain access to premium/founder-only features
Business Impact:
Loss of branding visibility
Potential revenue impact (paid tier bypass)
Trust Impact:
Users can present content without platform attribution
Root Cause
Missing server-side authorization checks
Feature restriction enforced only on frontend (client-side)
Recommendation
Enforce server-side validation for:
Founder-level features
Reject unauthorized modifications with proper error response (403 Forbidden)
Do not rely on frontend controls for access restriction
Severity
Medium