Disclaimer: This report reflects the submitter's account. It has not been independently verified unless marked Verified. The company may dispute this claim.
Scam Alert: achievable.me — nauthenticated Full Account Takeover via accountSetup GraphQL Mutation
Company / Program: achievable.me
Platform: Self-Hosted · Severity: critical · Scam type: ban
Published:
Reported by: kenjisubagja
The GraphQL API on api.achievable.me exposes an unauthenticated mutation, accountSetup(uuid, password), which allows an attacker to set or reset the password for any target account that has needsSetup: true. This vulnerability requires only a publicly discoverable userUuid and involves no email verification, setup tokens, or prior authentication.
Vulnerability Mechanism:
Public Identifier Exposure: Target userUuid values are accessible via public endpoints, shared study-report URLs, and directory listings.
Information Disclosure: An unauthenticated query to accountSetupSearch(userUuid) leaks the target's email address and confirms whether needsSetup is set to true.
Unauthenticated Password Setting: An attacker executes accountSetup(uuid, password) without supplying any session headers or authentication tokens. The server accepts the request (HTTP 200 OK) and sets the password for the account.
Account Takeover: The attacker subsequently calls the signIn mutation using the victim's email and the newly set attacker password to obtain a valid accessToken, gaining full access to the victim's account, personal data, and study records.
Impact: Critical (Authentication Bypass & Full Account Takeover). Affected account types include newly invited organization members, OAuth-registered accounts without set passwords, and unredeemed promo/gift accounts.