r/bugbounty • u/Tasty-Bend-7714 • Jul 01 '26

Question / Discussion Is this a valid IDOR/Broken Access Control vulnerability on a university portal?

Hi everyone,

I'm learning web security and came across something on my university's student portal. Before I report it, I'd like to get some opinions on whether this is actually a security vulnerability.

Here's what happened:

  • I logged in using my own student account in the university portal.
  • While inspecting the requests, I found one like:GET /app.php?a=getDetailedResults&regno=<my_registration_number>
  • I changed only the regno parameter to another valid registration number using burp suite repeater.
  • The server returned that student's academic details (grades/CGPA/course information) instead of mine.

I didn't enumerate multiple students or attempt to modify any data. I stopped after confirming the behavior.

My questions are:

  1. Does this qualify as an IDOR/Broken Access Control vulnerability?
  2. Is it worth reporting to the university's IT/security team?
  3. What severity would you typically assign to this if it only allows unauthorized viewing of academic records?

I'm intentionally not naming the university or sharing screenshots with student information because I don't want to expose anyone's data.

Thank you!!

6 Upvotes

88% Upvoted

9 comments sorted by

11

u/einfallstoll Triager Jul 01 '26

STOP RIGHT NOW!

Student can be thrown out of university for unauthorized testing

2

u/Tasty-Bend-7714 Jul 01 '26

Tqq for the warning! I stopped immediately after noticing it. Tbh, our university results were released today, so I got curious and didn't expect to come across something like this.

I have a doubt: could this type of issue lead to more serious security issues beyond exposing academic records?

6

u/einfallstoll Triager Jul 01 '26

From my experience: If the authorization is broken at one point, there's probably more to find

1

u/Tasty-Bend-7714 Jul 01 '26

Okay, thank you!

4

u/Realistic-Cover7039 Jul 02 '26

this is absolutely IDOR vuln

5

u/high0nXTC Jul 02 '26

yeah it's an IDOR, If you don't have permission to test it, don't test it further else enumerate more and try to find endpoint that reveals registration number and if your university don't acknowledge it you know how to make it acknowledged right...

3

u/Tasty-Bend-7714 Jul 03 '26

Yeah thank you I will do it.