Summary

This report details a case of HTTP Verb Tampering affecting the /archive/exist/team/ directory on a NASA web application. While a GET request would return a 401 Unauthorized, a POST request granted access to restricted internal documents, including RFI responses, internal team communications, and technical data. The issue has been resolved, and this disclosure aims to raise awareness about Broken Access Control vulnerabilities that result from inconsistent HTTP method validation.

Activity Feed