Description

As per the functionality we only can add user role as a "USER" in account Due to the no server side valaditon on "role" parameter , we can add new member as a "HOST" role with all HOST users privilege

Proof of Concept

1. while adding new user intercept the request in burp
2. change the POST body role paramater value as "HOST"
3. the newaly added user have HOST users privilege

refer ss/Video POC : https://drive.google.com/drive/folders/1CqD7SKaBMx3ms7Px3vKFR-9puI_a0V-a?usp=sharing

Impact

Due to the issue , we can assign role as HOST to user . without having functionality.

after new role we can Delete old HOST role Account . example: demohero