Summary
A normal (non-subscribed) user can bypass subscription restrictions and apply paid appearances/themes by manipulating the request, gaining unauthorized access to premium features.
Affected Platform
https:
Vulnerability Type
Access Control Bypass
Business Logic Flaw
Description
The application does not properly validate whether a user has an active subscription before applying premium appearances.
By intercepting the request and modifying the appearance name from a free theme to a paid one, the server accepts the request without verifying authorization, allowing free users to use premium features.
Steps to Reproduce
Login with a normal (non-premium) account.
Go to dashboard appearance/theme settings.
Select any free appearance.
Capture the request (e.g., via proxy).
Modify the request parameter:
Replace free appearance name with a paid appearance name.
Send the modified request.
Observe:
The paid appearance is successfully applied.
No subscription check is enforced.
Impact
Unauthorized access to paid/premium features.
Direct revenue loss for the platform.
Breaks subscription enforcement logic.
Can be easily automated and abused at scale.
Expected Behavior
Server should validate user subscription status before applying paid appearances.
Requests with unauthorized appearance values should be rejected.
Actual Behavior
Server accepts modified requests without verifying subscription.
Paid appearances can be used by free users.
Severity
Medium
Recommendation
Enforce server-side validation of subscription status.
Restrict appearance values using an allowlist based on user entitlement.
Do not rely on client-side controls for access restriction.
Additional Note
This is a classic business logic flaw, and similar checks should be reviewed across other premium features.