# Missing return after denial

Denial branch writes an error response but does not return, so the privileged action still runs

_Area: Web access control and IDOR. Seen in 3 disclosed reports; latest 2026-04-14. Updated 2026-10-24._

## How it works
A handler decides a request should be rejected, writes an error response (404, 403), and then keeps executing. In Go and most frameworks, writing a response does not end control flow; the code falls through into the privileged action. The broken assumption is that "we sent a denial" equals "we stopped the request." The client sees a rejection while the server may still run the create/update procedure [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-jgq2-qv8v-5cmj.md).

## Where it shows up
- Error/404/403 branches in HTTP handlers with no `return` (or `continue`/`break` in loops) after the response write.
- Validation that sets a status code but does not abort the request pipeline.
- Handlers that write a denial, then parse the request body and call a processor afterward.

## How to review
For each denial branch, confirm the handler returns immediately after writing the response, and that no processor call is reachable afterward. The invariant: a rejected request must produce zero state change and zero data disclosure. Verify by re-reading the resource after a rejected request, not by trusting the status code [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-jgq2-qv8v-5cmj.md). Trace the control flow from every error branch to the end of the handler; a response write alone is not a stop.

## Variants seen
- Missing `return` after a 404 in a Go handler, letting unauthenticated callers create/overwrite subscriptions [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-jgq2-qv8v-5cmj.md).

## Impact and severity
Unauthenticated actors created or overwrote data [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-jgq2-qv8v-5cmj.md). Severity rises when the action is unauthenticated and the fall-through reaches a write procedure, since the denial response masks the state change from the caller.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-jgq2-qv8v-5cmj.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-x462-jjpc-q4q4.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-8hp8-9fhr-pfm9.md