---
id: 7433
title: "Thanh xuân như một tách trà, tìm được một bug hết bà thanh xuân."
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/thanh-xuan-nhu-mot-tach-tra-tim-duoc-mot-bug-het-ba-thanh-xuan/"
published_at: "2019-08-18T08:00:00Z"
tags: ["bug-bounty", "api-security", "mobile-security", "idor", "broken-access-control", "writeup"]
phying_url: "https://phying.com/item/7433"
lang: en
---

# Thanh xuân như một tách trà, tìm được một bug hết bà thanh xuân.

## Summary

A bug bounty write-up on a restaurant management platform where staged tenant accounts revealed cross-restaurant IDOR and broken function-level authorization across web and mobile APIs.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **Published:** 2019-08-18T08:00:00Z
- **Original:** https://blog.viettelcybersecurity.com/thanh-xuan-nhu-mot-tach-tra-tim-duoc-mot-bug-het-ba-thanh-xuan/
- **Phying News:** https://phying.com/item/7433