Daily Writeups
@Daily_Writeups
3.56K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.56K subscribers
Daily Writeups
⤷ Title: API Security: Minimum Things Every Team Should Implement Before Going Live
════════════════════════
𐀪 Author: Umashankara Kalaiah
════════════════════════
ⴵ Time: Mon, 20 Apr 2026 03:21:57 GMT
════════════════════════
⌗ Tags: #cybersecurity #owasp_top_10 #authentication #authorization #api_security
Medium
API Security: Minimum Things Every Team Should Implement Before Going Live
APIs are now the backbone of modern applications. Mobile apps, web apps, partner integrations, microservices, and AI systems all depend on…
28 views
Daily Writeups
⤷ Title: 7 Critical Vulnerabilities Threaten Spring Security 7.0
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 22 Apr 2026 01:54:49 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authorization Bypass #CVE_2026_22752 #infosec #Java security #JWT Security #Patch Alert #Spring Security #Spring Security 7.0 #ssrf #TOCTOU #X.509 Impersonation
Daily CyberSecurity
7 Critical Vulnerabilities Threaten Spring Security 7.0
The Spring Security team has issued a series of security advisories detailing seven distinct vulnerabilities impacting the widely used authentication and authorization framework. While several fla…
15 views
Daily Writeups
⤷ Title: Critical 9.0 CVSS Flaw in ArcadeDB Allows Total Cross-Database Access
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 07 May 2026 02:17:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ArcadeDB #Authorization Bypass #CVE_2026_44221 #cybersecurity #Data Isolation #database security #infosec #Multi_Model DBMS #Multi_tenancy #Patch Alert
Daily CyberSecurity
Critical 9.0 CVSS Flaw in ArcadeDB Allows Total Cross-Database Access
ArcadeDB 26.4.1 fixes a critical 9.0 CVSS authorization bypass (CVE-2026-44221) that dismantles database isolation. Secure your multi-model data and patch now!
22 views
Daily Writeups
⤷ Title: Critical 9.4 CVSS pgAdmin 4 Flaws Enable Full OS Command Execution
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 15 May 2026 01:20:16 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authorization Bypass #CVE_2026_7813 #Cyber Security #database security #infosec #Patch Alert #pgAdmin 4 #pgAdmin 9.15 #PostgreSQL #rce #sql injection
Daily CyberSecurity
Critical 9.4 CVSS pgAdmin 4 Flaws Enable Full OS Command Execution
pgAdmin 4 v9.15 fixes a 9.4 CVSS auth bypass and multiple RCE flaws. Attackers can execute OS commands via SQL tools. Upgrade your pgAdmin server now!
21 views
Daily Writeups
⤷ Title: What is BOLA? API Broken Object Level Authorization Explained for Beginners
════════════════════════
𐀪 Author: Abrar Bin Habib
════════════════════════
ⴵ Time: Fri, 15 May 2026 17:36:40 GMT
════════════════════════
⌗ Tags: #owasp_api_top_10 #api_vulnerabilities #authorization #bola #api_security
Medium
What is BOLA? API Broken Object Level Authorization Explained for Beginners
“Imagine changing the number 1 to 2 in a website link and suddenly seeing someone else’s private data. That’s BOLA.”
42 views
Daily Writeups
⤷ Title: Login Sistemində Təhlükəsizlik: Auth Modulunda Görülən AppSec Tədbirlərinin bir hissəsi
════════════════════════
𐀪 Author: Kanan Kazimov
════════════════════════
ⴵ Time: Sat, 16 May 2026 08:10:02 GMT
════════════════════════
⌗ Tags: #application_security #authorization #web_security #authentication #cybersecurity
Medium
Login Sistemində Təhlükəsizlik: Auth Modulunda Görülən AppSec Tədbirlərinin bir hissəsi
1. User Enumeration Qorunması: Qeydiyyat zamanı daxil edilən e-poçtun bazada olub-olmamasından asılı olmayaraq eyni mesaj qaytarılır…
31 views
Daily Writeups
⤷ Title: Preventing Reserved Scope Name Misuse in API Platforms
════════════════════════
𐀪 Author: Wishula Jayathunga
════════════════════════
ⴵ Time: Mon, 18 May 2026 02:57:43 GMT
════════════════════════
⌗ Tags: #api_security #backend_governance #scope_validation #enterprise_api_management #authorization_design
Medium
Preventing Reserved Scope Name Misuse in API Platforms
In modern API ecosystems, scopes play a critical role in authorization and access control. They define what an application or user is…
29 views
Daily Writeups
⤷ Title: Keys to the Kingdom: Critical 9.9 CVSS Budibase Flaw Allows Total Tenant Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 01:40:37 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Account Takeover #Authorization Bypass #Budibase #CVE_2026_46425 #Cyber Security #DevSecOps #Identity Management #infosec #Patch Alert #privilege escalation #SCIM
Daily CyberSecurity
Keys to the Kingdom: Critical 9.9 CVSS Budibase Flaw Allows Total Tenant Takeover
Budibase patches a critical 9.9 CVSS SCIM authorization bypass (CVE-2026-46425). Basic users can delete admins and hijack accounts. Update now!
15 views
Daily Writeups
⤷ Title: New Apache Camel K Flaw (CVE-2026-45760) Enables Cross-Namespace Attacks
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 22 May 2026 03:12:15 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Apache Camel K #Authorization Bypass #Build Deputy Attack #Cloud Native Security #CVE_2026_45760 #Cyber Security #infosec #Kubernetes Namespace Bypass #Multi_Tenancy Defect #Patch Alert #Pod Generation Hijack
Daily CyberSecurity
New Apache Camel K Flaw (CVE-2026-45760) Enables Cross-Namespace Attacks
Apache Camel K fixes CVE-2026-45760, a critical cross-namespace "Build Deputy" flaw allowing authorized users to hijack pods in secure namespaces.
25 views
Daily Writeups
⤷ Title: HTTP 401 vs 403 vs 404 vs 405 — And Advanced Techniques to Bypass Unauthorized Pages
════════════════════════
𐀪 Author: Gehad Reda
════════════════════════
ⴵ Time: Mon, 01 Jun 2026 11:44:43 GMT
════════════════════════
⌗ Tags: #cybersecurity #bug_bounty #penetration_testing #authorization #bypass
Medium
HTTP 401 vs 403 vs 404 vs 405 — And Advanced Techniques to Bypass Unauthorized Pages
A practical guide for security researchers and bug bounty hunters
16 views
Daily Writeups
⤷ Title: AI Agents Calling Your APIs? Here’s How to Secure Them
════════════════════════
𐀪 Author: Curity
════════════════════════
ⴵ Time: Thu, 11 Jun 2026 10:24:20 GMT
════════════════════════
⌗ Tags: #ai_agent #authorization #oauth #api_security #ai_agent_security
Medium
AI Agents Calling Your APIs? Here’s How to Secure Them
At some point in the last year, an AI agent probably hit one of your API endpoints. Maybe it was one you built yourself. Maybe it was a…
41 views
Daily Writeups
⤷ Title: How to Build a Role-Based Access Control (RBAC) System
════════════════════════
𐀪 Author: Ushani Saubhagya
════════════════════════
ⴵ Time: Sat, 13 Jun 2026 11:53:32 GMT
════════════════════════
⌗ Tags: #authentication #authorization #role_based_access_control #software_security #application_security
Medium
How to Build a Role-Based Access Control (RBAC) System
A step-by-step guide to designing secure, scalable authorization systems using roles, permissions, and best practices.
28 views
Daily Writeups
⤷ Title: Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 22 Jun 2026 01:11:11 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #admin panel #Authorization Bypass #Avo #CVE_2026_55518 #Missing Authorization #privilege escalation #Rails Security #ruby on rails
Daily CyberSecurity
Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
CVE-2026-55518 is a critical Avo authorization bypass flaw enabling privilege escalation in Ruby on Rails admin panels. Update to Avo 3.32.1 now.
23 views
Daily Writeups
⤷ Title: 5 Authorization Mistakes I Keep Finding During Manual Application Security Testing
════════════════════════
𐀪 Author: Mohammed Khaleel ul hasan
════════════════════════
ⴵ Time: Tue, 30 Jun 2026 09:18:23 GMT
════════════════════════
⌗ Tags: #security #web_application_security #application_security #authorization #pentesting
Medium
5 Authorization Mistakes I Keep Finding During Manual Application Security Testing
What weeks of testing modern web applications taught me about Broken Access Control.
19 views
Daily Writeups
⤷ Title: API Authorization Testing: Insecure Object-Level Access Leading to Unauthorized User Management
════════════════════════
𐀪 Author: Ethical Hacker
════════════════════════
ⴵ Time: Mon, 06 Jul 2026 14:55:37 GMT
════════════════════════
⌗ Tags: #api_security #rbac_access_control #authorization #cyber_security_solutions #bug_bounty
Medium
🔐 API Authorization Testing: Insecure Object-Level Access Leading to Unauthorized User Management
Recently, I analyzed an API authorization issue where sensitive user management endpoints were exposed without proper authorization checks.
18 views
Daily Writeups
⤷ Title: Authorization at Scale:
Policy, Resource, and Tenant Boundaries in ASP.NET Core (.NET 9 Guide P3)
════════════════════════
𐀪 Author: Oleksii Sokol
════════════════════════
ⴵ Time: Fri, 10 Jul 2026 11:01:25 GMT
════════════════════════
⌗ Tags: #authorization #api_security #dotnet #software_architecture #aspnetcore
Medium
Authorization at Scale: Policy, Resource, and Tenant Boundaries in ASP.NET Core (.NET 9 Guide P3)
Policy-based and resource-based authorization, tenant isolation, step-up auth, auditing, and threat modeling for ASP.NET Core APIs that…
38 views
Daily Writeups
⤷ Title: Authorization Bypass via Privilege Persistence After Role Downgrade in Hasura PromptQL
════════════════════════
𐀪 Author: Ahmed Embaby
════════════════════════
ⴵ Time: Sat, 18 Jul 2026 15:12:35 GMT
════════════════════════
⌗ Tags: #web_security #authorization #bug_bounty #cybersecurity #graphql
Medium
Authorization Bypass via Privilege Persistence After Role Downgrade in Hasura PromptQL
Still an Admin. Just Not Officially
❤1
16 views
Daily Writeups
⤷ Title: The Bug Bounty Playbook: IDOR
════════════════════════
𐀪 Author: Abhishek meena
════════════════════════
ⴵ Time: Mon, 20 Jul 2026 22:27:44 GMT
════════════════════════
⌗ Tags: #bug_bounty #web_security #idor #authorization #hackerone
Medium
The Bug Bounty Playbook: IDOR
Part 1 of the Bug Bounty Playbook series. 252 disclosed HackerOne reports analysed. Five recurring patterns. One testing framework you can…
23 views
Daily Writeups
⤷ Title: Unpatched Plane Authorization Bypass CVE-2026-15342 Exposes Other Workspaces
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 27 Jul 2026 13:03:32 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authorization Bypass #broken access control #CERT/CC #CVE_2026_15342 #Multi_Tenant #open_source #Plane #Project Management #unpatched #VU#762226
Daily CyberSecurity
Unpatched Plane Authorization Bypass CVE-2026-15342 Exposes Other Workspaces
TL;DR CERT/CC published an advisory on July 21, 2026 for a Plane authorization bypass. Tracked as CVE-2026-15342, it lets a user in one workspace read, copy, or delete another workspace’s fi…
8 views
Daily Writeups
⤷ Title: Apache ActiveMQ Patches Authorization Bypass and DoS Flaws
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 28 Jul 2026 02:05:15 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ActiveMQ vulnerability #Apache ActiveMQ #Authorization Bypass #CVE_2026_59878 #CVE_2026_61487 #Denial of Service #Message Broker Security
Daily CyberSecurity
Apache ActiveMQ Patches Authorization Bypass and DoS Flaws
TL;DR The Apache Software Foundation fixed two Apache ActiveMQ vulnerabilities. One lets a low-privilege user bypass write permissions on protected queues. The other lets a remote attacker crash A…
10 views