# Partial match identity lookup bypass

Auth checks that match email domains, name prefixes, or wildcards instead of exact identity equality

_Area: Web access control and IDOR. Seen in 3 disclosed reports; one confirmed bounty: $2,500; latest 2026-09-23. Updated 2026-10-24._

## How it works
An authorization decision compares a caller-supplied identifier against a stored one using a partial match — domain-only email, name prefix, or wildcard pattern — instead of exact equality. The check passes for any record sharing the matched fragment, so the identifier stops being a secret or a proof of ownership. The broken assumption: that the compared value uniquely identifies the owner. Prefix/domain/wildcard matching makes it a class selector, not an identity.

## Where it shows up
- Lookup endpoints taking two fields (ID + email) where the email is compared by domain or substring [E3](https://bugbountylibrary.com/r/h1%3A968165.md)
- Authz helpers with a prefix allowlist and no else branch, so unprefixed names (raw UUIDs) fall through unchecked [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md)
- ACL rules that template user-controlled identifiers (%c/%u) into topic filters, then wildcard-match, without validating the identifier against the filter grammar's own metacharacters (+/#) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f42-97gr-vfhq.md)
- Write endpoints that never call the authz helper at all [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md)
- Sequential or guessable IDs behind a weak secondary check [E3](https://bugbountylibrary.com/r/h1%3A968165.md)

## How to review
Trace the identifier from input to the comparison. The invariant: the authorization predicate must be exact equality on a value the caller cannot forge or broaden, and every endpoint touching the resource must call it. For pattern ACLs, validate the substituted identifier against the filter grammar's metacharacters before substitution [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f42-97gr-vfhq.md). For prefix allowlists, enumerate every naming scheme and confirm each has an explicit allow/deny branch [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md). For two-field lookups, confirm the email is compared in full, not by domain [E3](https://bugbountylibrary.com/r/h1%3A968165.md).

## Variants seen
- Domain-only email match on an order-lookup endpoint, enabling enumeration of other customers' orders [E3](https://bugbountylibrary.com/r/h1%3A968165.md)
- Prefix allowlist with no fallthrough denial; UUID-named collections bypass checks, and write paths skip the helper entirely [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md)
- Unvalidated clientId substituted into pattern ACLs; clientId `+` matches across tenants [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f42-97gr-vfhq.md)

## Impact and severity
Cross-tenant read/write and disclosure of other customers' data [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f42-97gr-vfhq.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md)[E3](https://bugbountylibrary.com/r/h1%3A968165.md). Severity rises when IDs are sequential or guessable [E3](https://bugbountylibrary.com/r/h1%3A968165.md), when write/poison paths are also exposed [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md), and when the same flaw spans tenants rather than single users [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f42-97gr-vfhq.md).

## Why fixes fail
Prefix allowlists invite new naming schemes that fall through [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md); fixing the read path while leaving write endpoints unguarded leaves the hole open [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-5f42-97gr-vfhq.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-4g37-7p2c-38r9.md
- E3: https://bugbountylibrary.com/r/h1%3A968165.md