services / Azure / API Management user accounts

A developer-portal user account record in an Azure API Management (APIM) service instance.

User accounts can be used to obtain/manage subscriptions and subscription keys for APIs published through the APIM instance.

Microsoft.​ApiManagement/​service/​users/​write

Creates or updates a developer-portal user, letting an attacker register a controlled account for persistent access and alter existing user records/state.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links