---
name: web-access-control
description: "Guides a reviewer through finding broken object-level and role/tenant authorization (IDOR, mass assignment, inconsistent gates) on an authorized web target by mapping surfaces and testing trust boundaries."
---

# Web access control and IDOR

Reading or changing data that belongs to someone else, acting above your role, crossing tenants.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 52 newer reports it was not written from: following it finds about 52% of them._

## Approaching web access control and IDOR

Access control bugs live where the server trusts something the client controls: an object id, an actor id, a tenant id, a role flag, a path string, or a token. Your job is to find every place the server decides *who* and *what* separately, then check whether the two are actually bound together.

**Map first.** Inventory every endpoint, resolver, and mutation that takes an id or identity field. Note the auth model: sessions, roles, tenants, share links, tokens. Identify which resources have owners, parents, or tenants, and which are global. List alternate surfaces: deprecated routes, format variants, exports, previews, GraphQL, imports.

**Ask these questions at each surface:**
- Where does the object id come from, and is it bound to the caller's session, role, and tenant?
- Does authorization run before or after the fetch? Do errors differ for missing vs forbidden?
- Is the actor/owner/tenant taken from the request or derived server-side?
- Does every path to this resource enforce the same check? What about child objects and their parents?
- Can client input set privileged fields (role, status, approval, foreign keys)?
- Do responses serialize more than the caller should see?
- Are tokens, share links, and grants bound to tenant, user, and scope, and do revocations take effect?
- Are allowlists, origins, and hosts matched exactly?

**Use the patterns below as a checklist, not a script.** For each, confirm the trust boundary it describes exists in this target, then test the specific binding. Compare sibling endpoints for inconsistent enforcement. Treat every client-supplied identifier as suspect until you see it bound to server-side state. Record the exact request, the check that should have fired, and the observed gap.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Object ID without ownership check
Handler fetches or mutates by client-supplied id without binding the object to the caller

_42 reports · 26 confirmed bounties, median $2,700, up to $15,600._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/idor-missing-ownership-check.md

### Client-supplied actor identity trusted
Endpoints taking actor, owner, or user id from the request instead of binding it to the session

_19 reports · 13 confirmed bounties, median $3,000, up to $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/client-supplied-identity-trusted.md

### GraphQL resolver missing object authorization
Resolvers acting on an object ID without checking caller ownership, role, or tenant

_16 reports · 6 confirmed bounties, median $2,500, up to $25,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/graphql-resolver-authz-gap.md

### Stale grants after revocation
Removed or downgraded members, roles, keys, tokens, or indexes still authorizing access

_14 reports · 6 confirmed bounties, median $500, up to $3,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/stale-authorization-revocation.md

### Inconsistent authorization across endpoints
Same resource, different paths enforce access differently; check every endpoint, surface and code path separately

_14 reports · 9 confirmed bounties, median $1,000, up to $30,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/permission-check-inconsistency.md

### Mass assignment of privileged fields
Client input bound to models lets callers set roles, status, approval flags, or foreign keys

_11 reports · 7 confirmed bounties, median $3,000, up to $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/mass-assignment-privileged-fields.md

### Unauthenticated endpoint object exposure
Endpoints reachable without credentials that read or mutate records keyed by caller-supplied IDs

_11 reports · 5 confirmed bounties, median $4,000, up to $14,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/unauthenticated-rpc-or-endpoint.md

### Role assignment without caller privilege check
Endpoints that grant roles or scopes checking membership but not the caller's right to grant that level

_10 reports · 5 confirmed bounties, median $2,500, up to $8,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/privilege-escalation-role-endpoint.md

### Child object ignores parent visibility
Child authorized on its own flag or caller context, never on parent or source visibility

_10 reports · 5 confirmed bounties, median $1,337, up to $2,500._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/child-object-ignores-parent-visibility.md

### Tenant ID Not Scoped to Caller
Handlers that authorize on session or one ID but act on a client-supplied tenant or parent ID.

_9 reports · 6 confirmed bounties, median $935, up to $1,250._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/cross-tenant-id-not-scoped.md

### Unscoped tokens grant cross-tenant access
Token validated for validity but not bound to tenant, user, role, or endpoint it is used against

_9 reports · 4 confirmed bounties, median $950, up to $22,530._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/token-scope-not-per-tenant.md

### Path traversal auth bypass
Auth checks one path string; the resource is resolved from a different, normalized path

_8 reports · 4 confirmed bounties, median $7,000, up to $11,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/path-traversal-authz-bypass.md

### Origin and host validation bypass
Loose origin, host, or scheme checks accepting undefined, case, trailing dots, or attacker-supplied URLs

_8 reports · 4 confirmed bounties, median $1,375, up to $18,834._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/origin-validation-bypass.md

### Field-level authorization missing in serializers
Responses serializing whole models or joined records, exposing tokens, emails, PINs, or unauthorized targets

_8 reports · 4 confirmed bounties, median $12,250, up to $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/field-level-authz-missing.md

### Prefix and substring allowlist bypass
Allowlist checks using prefix, suffix, substring, or unanchored glob instead of exact normalized equality

_8 reports · 3 confirmed bounties, median $1,000, up to $6,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/allowlist-prefix-match-bypass.md

### Hidden identifiers leak private accounts
Private fields hidden by UI or privacy settings returned by side-channel APIs, tokens, or SSR blobs

_7 reports · 5 confirmed bounties, median $1,000, up to $7,500._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/info-disclosure-identifiers.md

### Client-side-only authorization checks
Privileged action gated only in UI; backend endpoint accepts it without its own server-side check

_7 reports · 2 confirmed bounties: $150 and $1,500._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/client-side-only-authorization.md

### Alternate endpoint skips authorization checks
Same object reachable via a second route, format, version, or domain that skips the primary path's check

_6 reports · 3 confirmed bounties, median $1,000, up to $2,500._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/alternate-endpoint-skips-checks.md

### Cross-site conditional response leak
Endpoints whose status, format, redirect, or timing differs by session user or content match

_6 reports · 5 confirmed bounties, median $1,120, up to $4,337._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/xs-leak-conditional-response.md

### Missing or weakened permission gate
Handler acts on a resource without the exact permission check, or with a weaker one

_6 reports · 2 confirmed bounties: $500 and $12,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/permission-gate-skipped.md

### Existence Leak via Error Differences
Missing vs forbidden objects returning different status, body, timing, or side effects, leaking existence

_5 reports · 5 confirmed bounties, median $2,400, up to $15,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/existence-oracle-error-diff.md

### CSRF via GET and path smuggling
State-changing actions reachable by GET, path traversal into API URLs, or CSRF tokens bound to the wrong scope

_5 reports · 3 confirmed bounties, median $500, up to $7,500._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/csrf-mutation-via-get.md

### Share link policy bypass
Share/preview endpoints that mint or accept tokens without enforcing password, type, or revocation policy

_5 reports · 3 confirmed bounties, median $250, up to $3,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/share-link-policy-bypass.md

### GraphQL mutation missing authorization check
Mutations acting on objects or roles without verifying caller ownership, tenant, or permission

_5 reports · 3 confirmed bounties, median $1,500, up to $2,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/mutation-permission-check-missing.md

### Weaker permission unlocks privileged operation
Does a weaker, implied, or per-object grant satisfy a check meant for a stronger permission?

_5 reports · one confirmed bounty: $1,900._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/weaker-permission-satisfies-stronger.md

### Unchecked object resolution (IDOR)
IDs, foreign keys or URNs resolved server-side without binding the object to the caller's rights

_5 reports · one confirmed bounty: $11,250._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/ownership-check-missing-on-entity.md

### Export endpoints bypassing visibility rules
Export or bundle endpoints that skip privacy, removal, or disclosure filters applied elsewhere

_4 reports · 3 confirmed bounties, median $10,000, up to $12,500._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/export-skips-visibility.md

### Path traversal in file path handling
User-controlled path reaching a file or object-store operation without normalization and confinement to a fixed base

_4 reports · one confirmed bounty: $1,500._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/path-traversal-unsanitized-file-paths.md

### Move and copy permission bypass
Move, copy, or re-attach paths that skip ownership or role checks on source or destination

_4 reports · 2 confirmed bounties: $600 and $1,200._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/privilege-escalation-via-move-copy-operations.md

### GraphQL resolver missing permission checks
GraphQL fields or mutations returning protected data without the scope, role, or tenant check the UI enforces

_4 reports · 3 confirmed bounties, median $500, up to $800._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/graphql-resolver-skips-permission-check.md

### Reflected-origin CORS with credentials
Origin echoed into ACAO with credentials; validator parses origin differently than the browser

_3 reports · 2 confirmed bounties: $500 and $3,134._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/cors-credentialed-reflection.md

### Hidden parameter authorization bypass
Client-set flags or bracketed field names that change which account is resolved or skip an auth check

_3 reports · 2 confirmed bounties: $10,000 and $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/hidden-parameter-authorization-bypass.md

### Intent and scheme launch consent bypass
App launches via redirects, callbacks or trusted schemes that skip user gesture and consent checks

_3 reports · one confirmed bounty: $3,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/intent-scheme-launch-bypass.md

### ID-keyed account reset and update IDOR
Account reset, MFA, or profile endpoints keyed by client-supplied user id without ownership check

_3 reports · 2 confirmed bounties: $5,000 and $6,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/id-keyed-account-takeover.md

### Client-supplied permission signal trusted
Server re-derives identity and rights from its own state, not from client-sent session, secret, or permission values.

_3 reports · one confirmed bounty: $500._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/client-supplied-permission-signal-trusted.md

### Cross-endpoint identifier resolution without authorization
An ID from one product accepted by an unrelated RPC that resolves it without checking ownership or current membership

_3 reports · 2 confirmed bounties: $1,337 and $10,633._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/id-reuse-across-unrelated-endpoints.md

### Global ID type confusion in mutations
Mutation resolves a global ID without asserting the object's class before acting or checking ability

_2 reports · 2 confirmed bounties: $4,000 and $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/type-confusion-global-id.md

### Import flows trust client flags
Import or template flows that install services, namespaces, or relations without checking permission on each object

_2 reports · 2 confirmed bounties: $750 and $11,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/import-trusts-template-flags.md

### GraphQL private data without ownership check
Resolvers returning members or scopes by ID without an owner, privacy, or tenant filter

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/graphql-private-list-no-ownership.md

### Weaker permission satisfies privileged check
Permission checks where a weaker, implied, or zero-valued grant passes a check meant for a stronger one

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/weaker-permission-satisfies-privileged-check.md

### File reference widens visibility policy
Inline file references or content URIs that re-grant access without rechecking the viewer's permission

_2 reports · 2 confirmed bounties: $500 and $2,000._
Full pattern: https://bugbountylibrary.com/skills/web-access-control/file-reference-widens-visibility.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Invite acceptance grants elevated role**: Invite or membership acceptance flows that set role without verifying inviter privilege or ownership (https://bugbountylibrary.com/r/h1%3A152067.md)
- **Dot resource ID normalized into list endpoint**: Resource ID path param accepting dot or traversal values that normalize into a list-all route (https://bugbountylibrary.com/r/h1%3A1575014.md)
- **Invite flow skips account state check**: Invite or activation endpoints that do not verify the account is unactivated or unbound (https://bugbountylibrary.com/r/h1%3A1266828.md)
- **Unauthenticated diagnostic endpoint leaks secrets**: Error log, proxy, or debug endpoints reachable without auth exposing requests, cookies, or tokens (https://bugbountylibrary.com/r/h1%3A2891449.md)