How Can a Company Book High-Paying Loads Using a Low-Rated Account?

Sounds like the company is leveraging a security gap, perhaps through what they term 'security through (in)visibility.' Essentially, while low-rated accounts can't see the best loads initially, if they know the load ID from a high-rated account, they can use that ID with their low-rated account. It seems like a security flaw, but it’s crucial that high and low-rated accounts aren’t colluding to exploit this.

There could be a number of things happening here. Without knowing the specific website, one possibility is that the permission checks are flawed. For example, it might be checking a value sent from the frontend instead of looking it up in the database. Another way this could happen is if there's no proper permission check, allowing someone to manually supply a value to the API. It could also be that all loads are available to book, but the interface only shows certain loads to different rated accounts. So, they could get a load ID from the high-rated account and book it with the low-rated account by changing the load ID accordingly.

If the backend allows bookings for loads that shouldn’t be accessible based on ratings, then there’s definitely a lack of proper permission checks. It’s critical that the session making the request is the same one that gets the booking. If this can’t be ensured, then there's a high chance for abuse.