# Shared pool cross-context leak

Shared session pools, caches, or event streams that filter by one identity dimension or none

_Area: Web access control and IDOR. Seen in 3 disclosed reports; latest 2026-09-03. Updated 2026-10-25._

## How it works
A shared channel — a broadcast pool, a response cache, an event stream — serves many contexts but filters by only one dimension of identity, or none. The assumption that breaks is "everyone in this pool is entitled to everything written to it." Authorization enforced on the request handler is not re-applied at the point of delivery, so a lower-privilege or different-tenant context receives data filtered for someone else.

## Where it shows up
- Read-only/publish/guest sessions registered into the same session or push pool as authenticated clients [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mw8r-mw84-88v2.md)
- Broadcast helpers that iterate all sessions without checking role or document access [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mw8r-mw84-88v2.md)
- Cache keys built from path, query, and user id only, omitting role, share, tenant, or policy [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6w9-5g5j-jh2p.md)
- Token types (share, guest) whose identity claim is null, collapsing many principals into one cache bucket [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6w9-5g5j-jh2p.md)
- Push/stream paths that check only coarse dashboard access before subscribing, then broadcast every event without per-recipient ACLs [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-228v-wc5r-j8m7.md)
- Products with both pull-based log APIs and push-based streams: the pull path filters per record, the stream path does not [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-228v-wc5r-j8m7.md)

## How to review
For each shared pool, cache, or stream, enumerate every authorization dimension the response depends on (user, role, share, tenant, publish flag, document/action ACL) and confirm the key or delivery filter includes all of them. The invariant: two contexts with different access rights must never resolve to the same pool slot or cache entry, and no broadcast may reach a subscriber not entitled to that specific record. For null-claim tokens, trace issuance: if a token type leaves the identity field null, check whether null collapses distinct principals into one bucket [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6w9-5g5j-jh2p.md). For streams, compare the pull handler's per-record filter against the broadcast callback and confirm the same check runs per recipient [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-228v-wc5r-j8m7.md).

## Variants seen
- Publish-mode WebSocket sessions sharing the broadcast pool with authenticated clients, receiving unfiltered edits [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mw8r-mw84-88v2.md)
- Response cache key omitting share/role context, serving another share's filtered response [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6w9-5g5j-jh2p.md)
- Event stream broadcasting action output to all subscribers without per-action ACL checks [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-228v-wc5r-j8m7.md)

## Impact and severity
Live edits to protected and forbidden documents delivered to anonymous readers [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mw8r-mw84-88v2.md); cross-share data disclosure via cache [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6w9-5g5j-jh2p.md); protected action output leaked to low-privileged users [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-228v-wc5r-j8m7.md). Severity rises when the leak is passive (no interaction needed) and continuous, as with a live broadcast or event stream [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mw8r-mw84-88v2.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-228v-wc5r-j8m7.md), and when the shared pool spans tenants or roles rather than a single user.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-mw8r-mw84-88v2.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-c6w9-5g5j-jh2p.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-228v-wc5r-j8m7.md