It’s 2020. Security researcher Sanjana Sarda at Independent Security Evaluators is testing the Bumble dating app. Bumble has a premium tier called “Bumble Boost” that costs money and unlocks features: seeing who swiped right on you, extending matches, re-matching with expired connections.
Sarda opened a proxy to inspect the API calls the app made. She noticed that the premium features called specific API endpoints. She tried calling those endpoints with her free-tier account token.
The API accepted them. Every premium feature worked. The server never checked whether her account had a Bumble Boost subscription — it only checked that she was logged in.
Beyond free premium access, Sarda found that certain API endpoints intended for administrative use were reachable by regular users. She could demote other users’ accounts, access internal user data, and call moderation functions — all using a regular user token.
The Bumble API checked authentication on every request. It did not check whether the authenticated user’s role entitled them to call each specific function.
Bumble has over 100 million registered users. Every one of them could have bypassed the paywall and called admin functions.
Sarda didn’t steal a token, guess a password, or enumerate object IDs. She called the exact endpoints that premium and admin users were supposed to call — using a free user account. The API stopped at “is this a valid session?” and never asked “does this session have the right to call this function?”