# Unauthenticated endpoint mutates shared state

Destructive write or wipe reachable without caller authentication, especially on streaming or alternate API paths

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; one confirmed bounty: $28,000; latest 2026-08-20. Updated 2026-10-31._

## How it works
The endpoint assumes that reaching a destructive handler implies the caller was authenticated. That assumption breaks when the auth check lives on one path (a unary interceptor, a UI, a record-level ACL) but the destructive operation is reachable on another path that skips it. The handler then performs a shared-state mutation — delete, overwrite, replace — on behalf of an anonymous or under-privileged caller.

## Where it shows up
- Streaming RPCs (gRPC streams) that bypass unary interceptors and reach destructive handlers [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rrwh-6jrq-wp5v.md)
- Import/snapshot/restore handlers that call a destructive prepare/delete before consuming input [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rrwh-6jrq-wp5v.md)
- Multiple front-end APIs to one backend (web session, developer portal, protobuf gateway) with differing auth [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2021-09-13-hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts.md)
- `forceDelete`-style operations that skip record-level ACLs [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2021-09-13-hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts.md)
- Zone/namespace/container deletion exposed to any authenticated user [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2021-09-13-hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts.md)
- Proxied parameters that reach a privileged backend path [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-points-com.md)
- Endpoints returning tokens for arbitrary users [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-points-com.md)

## How to review
For every handler that writes, deletes, or replaces shared state, trace the call path back to the entry point and confirm an authentication and authorization check runs on that exact path. The invariant: no destructive mutation executes before the caller's identity and permission are verified. Check streaming and unary paths separately; check each front-end API to the same backend; check that record-level ACLs are enforced on bulk/force operations, not just normal ones.

## Variants seen
- Streaming RPC missing stream interceptor reaches Badger Prepare(), wiping a group store [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rrwh-6jrq-wp5v.md)
- Public-scope container with weak permissions allows forceDelete and _defaultZone deletion [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2021-09-13-hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts.md)
- Proxied parameter reaches god-token-signed backend; recipient endpoint leaks validation tokens [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-points-com.md)
- Weak session signing secret enables admin console takeover [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-points-com.md)

## Impact and severity
Wiping or replacing shared state destroys all tenants' data: Apple Shortcuts shared links and gallery [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2021-09-13-hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts.md), a Dgraph group store [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rrwh-6jrq-wp5v.md), and mass order/token exposure [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-points-com.md). Severity is high because the action is unauthenticated or low-privilege and irreversible; blast radius grows with shared scope and lack of backups.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2021-09-13-hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts.md
- E2: https://bugbountylibrary.com/r/blog%3Asamcurry-net-points-com.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-rrwh-6jrq-wp5v.md