I discovered and responsibly disclosed a Broken Access Control vulnerability in a government portal serving 300K+ students
Source Reddit Cybersecurity
Rated by Threat Radar
Data as of 21 Jun 2026, 15:54 UTC
What to do
AI-suggested
The vulnerability has been fixed as confirmed by the reporting researcher and authorities. No further action is required from end users. Developers should ensure that authorization checks are enforced on the backend rather than relying solely on frontend controls.
Discussion
A Broken Access Control vulnerability was discovered and responsibly disclosed in a government student welfare portal used by over 300,000 students in India. The flaw allowed unauthorized authenticated users to access privileged functionality and sensitive beneficiary information, including addresses and government benefit details. The vulnerability stemmed from authorization being enforced only on the frontend, without proper backend validation. The issue was reported to CERT-In and relevant authorities, and has since been confirmed fixed.
r/cybersecurity (opens in a new tab)u/ConsiderationOne34210 points0 comments
A few weeks ago, I noticed something unusual while using a government student welfare portal in India.
Certain functionality appeared to be controlled by information stored on the client side, which made me wonder:
"Is the backend actually enforcing authorization, or is the frontend simply hiding functionality?"
After some limited testing using my own account, I discovered a Broken Access Control vulnerability that allowed unauthorized authenticated users to access functionality intended for privileged users.
The issue potentially exposed sensitive beneficiary information, including address details and information related to government benefit disbursements.
I documented my findings, reported them to CERT-In and the concerned authorities, provided a PoC when requested, and recently received confirmation that the issue has been fixed.
I've written a detailed technical breakdown covering:
• How the vulnerability was discovered
• The root cause
• Why frontend-only authorization is dangerous
• The responsible disclosure process
• Lessons for developers
Full write-up: https://medium.com/@theprinceraj/discovering-a-security-flaw-in-a-government-portal-used-by-3-lakh-students-ad3bf67a0513