BugForge - Daily - Shady Oaks Finance (Repeat)

Daily - Shady Oaks Finance (Repeat)

This is a repeat of the daily challenge from January 16th, 2026.

---

Vulnerability Overview

A broken access control vulnerability in the Shady Oaks Finance application exposes administrative endpoints without proper server-side authorization checks. By enumerating application endpoints and directly accessing admin/* routes as a standard user, it is possible to reach privileged functionality and retrieve sensitive data without an admin role.

Key Issues:

• Administrative endpoints are accessible without role-based authorization checks
• The backend relies on assumed user roles rather than validating permissions per request
• Endpoint enumeration via JS analysis reveals restricted routes that are not properly protected

---

Vulnerabilities Covered

• Broken Access Control (Missing Function-Level Authorization)

---

Classification

• OWASP Top 10: A01:2021 - Broken Access Control
• Vulnerability Type: Missing Function-Level Authorization
• Attack Surface: Admin endpoint routes
• CWE: CWE-285 - Improper Authorization

---