# Missing authorization on resource scope

Operations that act on a referenced resource without checking permission on that resource's own scope

_Area: Cloud and container security. Seen in 2 disclosed reports; one confirmed bounty: $5,000; latest 2022-09-20. Updated 2026-10-23._

## How it works
An operation names a resource (a volume, a service, a topic) and the backend checks that the caller may call the operation, but not that the caller holds the required permission on the referenced resource itself. The permission check is anchored to the wrong object: the caller's own project, the API surface, or nothing at all. Because the resource identifier is often a guessable or leakable string (an OCID, a service name, a UUID), anyone who can reach the endpoint and supply an identifier can act on a resource they do not own. The broken assumption is that "can call the API" implies "is authorized for the object named in the request."

## Where it shows up
- Attach/link/associate operations that take a target resource ID as a parameter [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-access.md)
- Config or creation calls with hidden or undocumented fields that trigger side effects on other objects [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md)[E4](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-5k-service-dependencies-html.md)
- Numeric version/type fields where validation may be skipped at boundary values [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md)
- Credential-issuing paths (identity pools, workload credentials) whose policy grants wildcard or broad scope [E3](https://bugbountylibrary.com/r/bc%3Ad42146b3-4768-43c2-8a54-c361b342943a.md)
- Broadcast channels (MQTT, pubsub, websocket) that emit identifiers used as the sole access token [E3](https://bugbountylibrary.com/r/bc%3Ad42146b3-4768-43c2-8a54-c361b342943a.md)
- Cross-tenancy or cross-project operations accepted with only an identifier [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-access.md)

## How to review
For every operation that references another resource, identify the permission the docs require *in that resource's scope* and confirm the code enforces it there, not on the caller's own scope. The invariant: authorization is evaluated against the referenced resource's compartment/tenant/project, and cross-boundary references are rejected unless explicitly permitted. Check that hidden/internal fields cannot cause server-side actions on objects the caller lacks rights to [E4](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-5k-service-dependencies-html.md), and that validation runs on all values including overflow ranges [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md). For credential paths, confirm issued policies are scoped to the caller's own resources, not wildcards [E3](https://bugbountylibrary.com/r/bc%3Ad42146b3-4768-43c2-8a54-c361b342943a.md).

## Variants seen
- Attach operation missing per-resource write permission, working across tenancies [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-access.md)
- Creation call skipping name-match validation, enabling impersonation of other services [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md)
- Hidden dependency field auto-enabling services without the bind permission [E4](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-5k-service-dependencies-html.md)
- Unauthenticated credential pool granting wildcard subscription that leaks all identifiers [E3](https://bugbountylibrary.com/r/bc%3Ad42146b3-4768-43c2-8a54-c361b342943a.md)

## Impact and severity
Critical: cross-tenant read/write of storage volumes [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-access.md), impersonation and enabling/disabling of private APIs [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md)[E4](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-5k-service-dependencies-html.md), and bulk real-time access to every tenant's data via leaked identifiers [E3](https://bugbountylibrary.com/r/bc%3Ad42146b3-4768-43c2-8a54-c361b342943a.md). Severity rises when identifiers are guessable or broadcast, when operations cross tenancy boundaries, and when the resource is data-bearing storage or credentials.

## Why fixes fail
Partial fixes that validate one field (e.g. name) but not boundary values (overflow range) leave the bypass open [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md); fixes must cover every path that reaches the same side effect.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-access.md
- E3: https://bugbountylibrary.com/r/bc%3Ad42146b3-4768-43c2-8a54-c361b342943a.md
- E4: https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-5k-service-dependencies-html.md