🎯 New Report #3591764: Business Logic Bypass Allows Setting “Read Access” Role Without Pro Plan Subscription
🔺Severity: Medium
👽 Reporter: ziadmomen
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Lovable VDP
💵 Bounty: null
🕐 Submitted: 2026-03-08
⏰ Disclosed: 2026-03-16 12:00:45
📝 Summary: A business logic vulnerability was identified that allowed users on a free plan to generate an invitation link that assigned the "Read Access" role, which was intended to be restricted to users with a Pro Plan subscription. The vulnerability was triggered by manipulating the invitation creation process to bypass the subscription-based permission restrictions.
📂 Report JSON File: 3591764
@hackeronereports