Together with @samwcyo and @iangcarroll - all 3 of us being avid Formula1 Fans, we were looking at the security of the whole ecosystem. That's how we stumbled upon a severe vulnerability in a critical portal managed by the @fia, that was reported and fixed in <24 hours.

To race in F1, drivers need an FIA Super Licence - the golden ticket of motorsport. The @fia (@F1 1's governing body) also categorizes drivers as Bronze/Silver/Gold/Platinum for other racing events. This is managed through a web portal - https://driverscategorisation....

The portal is public - anyone can create an account to apply for driver categorization. You upload documents, submit your racing history, and wait for approval. Same goes for professional F1 drivers - They get automatic Platinum status and use the same system.

We created a test account to poke around. Like any website, you can update your profile - change your name, email, etc. Nothing special. Just a normal user editing their own information. But then we noticed something interesting...

When we sent a request to update our profile, the server sent back MORE information than we gave it. We sent: name and email We got back: name, email, birthdate, status, and... a field called "roles" Why would the server tell us about roles? 🤔

We looked at the website's code and found different role types: DRIVER (regular users) FIA_STAFF (employees) ADMIN (full access) We had a theory: What if we just... asked to be an admin? Would the server actually check? Or just trust us?

We modified our profile update to include: "Make me an ADMIN" (Technically: added an ADMIN role to the JSON request) Hit send. Got back: HTTP 200 Success Wait... did that actually work? (Yes it did...)

We logged back in. The entire interface changed. We weren't seeing a driver's dashboard anymore. We were seeing the ADMINISTRATOR panel - with access to: Every driver application All uploaded documents Internal FIA comments Staff management tools

We could also see internal FIA communications: Committee discussions about driver performance, private evaluations, and confidential decision-making processes. Everything the FIA staff could see - we could see. One request turned us from users into administrators.

For the sake of it we looked up Max Verstappen's @Max33Verstappen profile, which allowed to download His passport His personal contact info His FIA correspondence His license documents

Important Clarification - We did NOT download or save any passports or sensitive personal information. We validated the vulnerability existed, took screenshots for proof, and immediately stopped testing. All test data was deleted. No driver information was compromised by us.

So what was the bug? It's called "Mass Assignment" - a classic web / api security flaw. In simple terms: The server trusted whatever we sent it, without checking if we were ALLOWED to change those fields.

We worked with the @fia to promptly fix the issue, Shoutout to their team for the rapid response and taking the matter seriously.

To read more about our work, and next blogs to come - follow along @samwcyo, @iangcarroll and check our blog post 👇 https://x.com/iangcarroll/stat... http://ian.sh/fia Thank you for your attention 🫡

@samwcyo @iangcarroll direct blog link - http://ian.sh/fia

@galnagli @Formula1 @samwcyo did you use burpsuite to add the role to the JSON request?

@galnagli @Formula1 @samwcyo It's probably a bad idea to admit the commission of a crime on X. Evenmoreso than it was on a hacker BBS in the '80s.

@galnagli @Formula1 @samwcyo even Max Verstappen needs a cv these days

@galnagli @Formula1 @samwcyo McLaren will pay for this

@galnagli @Formula1 @samwcyo This is crazy

@galnagli @Formula1 @samwcyo INSANE omggg

@galnagli @Formula1 @samwcyo How do software developers forget to validate data ownership and permission level before persisting data? Or is this just the inevitable result of vibe coding slop?

@galnagli @Formula1 @samwcyo @Kevin_Koobs 🙀

@galnagli @Formula1 @samwcyo Did you get a big bounty

@galnagli @Formula1 @samwcyo cool write-up!

@galnagli @Formula1 @samwcyo crazyyyy!!

@galnagli @Formula1 @samwcyo Oh lord

@galnagli @Formula1 @samwcyo You're amazing 🤜🤛

@galnagli @Formula1 @samwcyo @MarcOverIP lol

@galnagli @Formula1 @samwcyo What a dumb stupid design. Have they never heard of encryption of the json so it can’t be modified? Have they never stored the context server side also so you can compare and catch modification? Bet the passport isn’t encrypted either.

@galnagli @Formula1 @samwcyo Just out of curiosity, did their bounty you with VIP tickets

@galnagli @Formula1 @samwcyo nice find 🤜