I have a multi-profile app where each user has a separate Bubble user account per role (e.g. one per company they administer). To switch between profiles, I use a frontend workflow that: Assigns a temporary password to the target user Logs the current user in as that user using the temporary passw…

[image] richard32: What I wasn’t sure about was whether putting that same condition in a front end workflow makes it easy for a malicious actor to circumvent. E.g. is there some mechanism whereby they can “bypass” the conditional because it’s in the front end rather than the back end? No, bec…

I think the support team would be a good call here. It’s not a bug but they also help users explore all kinds of things, this topic included

thanks Fede. How should I raise it with them? Is there a separate forum channel for that?

This is expected behaviour, and I believe the security dashboard flags this to you. Specifically, here’s why your implementation is secure: [image] richard32: The frontend filters the list of switchable users to only show the current user’s sister/child users (those sharing the same master use…

Super helpful, thanks George. Yes, it would be simple to add a workflow condition that checks precisely what you wrote. And indeed if I were to move it to a back end workflow, this is the condition I’d include to lock it down. What I wasn’t sure about was whether putting that same condition in a fr…

[image] richard32: Has anyone found a cleaner solution to this pattern that avoids returning any credential to the frontend? The backend can actually “notify” the front end of data changes via the Trigger a custom event when data changes action. You might find the technique outlined in this p…

thanks, @georgecollier , very clear. thanks also @sudsy , this is a nice alternative. Helpful to know.

Security vulnerability in profile-switching flow — intercepting and substituting a different user ID

Questions

sudsy June 1, 2026, 11:33pm 7

The backend can actually “notify” the front end of data changes via the Trigger a custom event when data changes action. You might find the technique outlined in this post to be helpful.

Simpler, more secure alternative to API / App Connector for "returning" data

Topic		Replies	Views
Why all of your server-side redirects are insecure Tips	45	1551	December 11, 2024
The Ultimate Guide to Bubble Security is out - 300 pages of privacy and security content Tips	42	9508	October 7, 2024
Linking User Accounts Need help	3	140	July 22, 2024
Discovery: How to avoid users hacking your reset password page? Showcase	6	809	February 16, 2024
Why your backend workflows might be your app's biggest vulnerability Tips	74	2816	March 4, 2025

Security vulnerability in profile-switching flow — intercepting and substituting a different user ID

Related topics