# Authorization checked before mutation

Authz decided on pre-mutation or body-supplied ownership, then owner/author fields reassigned

_Area: Web access control and IDOR. Seen in 3 disclosed reports; latest 2026-10-21. Updated 2026-10-24._

## How it works
An authorization decision is made against one version of an object, then the object is changed using data the decision never covered. The check reads ownership from the request body, from the stored pre-mutation state, or from a field the caller can write; the mutation then reassigns owner, author, project or lead fields. Nothing binds the identity that was authorized to the identity that ends up stored, so a low-privileged caller can act on another tenant's or another user's resource.

## Where it shows up
- Update endpoints where the object is selected by URL path but ownership is read from submitted labels or fields [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md)
- PATCH routes whose permission dependency is weaker than the paired DELETE route [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c78w-2q4r-68r7.md)
- Delete guards that authorize against a mutable field (lead_id, creator_id, owner_id) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c78w-2q4r-68r7.md)
- Save controllers that run permission checks before populating request-controlled relations (authors, owners) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qq2c-2q8j-jh27.md)
- Permission helpers evaluated against the old relation list, with no re-check after mutation [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qq2c-2q8j-jh27.md)

## How to review
Identify every field that feeds an authorization decision and confirm the caller cannot write it, or that the decision is re-evaluated after mutation. The invariant: the ownership/identity used for the check must be the stored, server-controlled value and must equal the object actually mutated. Compare route pairs (PATCH vs DELETE, update vs create) for dependency asymmetry. Trace the save flow to confirm no request-controlled ownership field is applied after the gate.

## Variants seen
- Body-supplied ownership labels authorize a URL-selected object [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md)
- Weaker PATCH permission lets members rewrite owner resources, then mutable lead_id bypasses delete guard [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c78w-2q4r-68r7.md)
- Pre-mutation author check, then attacker-supplied authors[] applied [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qq2c-2q8j-jh27.md)

## Impact and severity
Cross-project takeover of workflow runs [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md), owner-resource rewrites and delete-guard bypass [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c78w-2q4r-68r7.md), authorship spoofing [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qq2c-2q8j-jh27.md). Severity rises when the mutable field also gates later privileged actions, chaining a write into a delete or takeover.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-c78w-2q4r-68r7.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-qq2c-2q8j-jh27.md