# Alternate endpoint skips authorization checks

Same object reachable via a second route, format, version, or domain that skips the primary path's check

_Area: Web access control and IDOR. Seen in 6 disclosed reports; 3 confirmed bounties, median $1,000, range $300-$2,500; latest 2022-09-22. Updated 2026-10-23._

## How it works
Authorization is enforced on the primary route, but a second route reaches the same data through a different code path that never runs the check. The broken assumption is that the guarded path is the only way in: a superseded API version, a format variant, a channel-scoped endpoint, or an alternate serving domain still reaches the object. The check lives in one layer (view, storefront middleware, new API, primary domain) while the data is reachable through another.

## Where it shows up
- Superseded API versions still live in production after a replacement shipped [E2](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-11-optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-disclo.md)
- Format variants of a route (`.js`, `.json`, `.atom`) or content-negotiated renderers branching on `Accept` [E3](https://bugbountylibrary.com/r/h1%3A348443.md)[E5](https://bugbountylibrary.com/r/h1%3A1424291.md)
- Admin/widget/channel-scoped endpoints that skip storefront password or visibility checks [E4](https://bugbountylibrary.com/r/h1%3A93394.md)
- Alternate serving domains (Pages/CDN/preview subdomains) that render the same resource without the primary domain's middleware [E6](https://bugbountylibrary.com/r/h1%3A1591412.md)
- Authorization done in templates/HAML rather than the controller action [E3](https://bugbountylibrary.com/r/h1%3A348443.md)
- Separate ingestion paths into the same store (email patch vs git push) that skip policy pre-checks [E7](https://bugbountylibrary.com/r/h1%3A526570.md)

## How to review
For every object-serving route, enumerate every path that returns the object and confirm each runs the same authorization check. The invariant: the check must be enforced in the controller/service layer, not the view, and must apply to all formats, endpoint versions, and serving domains. Concretely: grep for the model lookup, trace each caller; test format suffixes and `Accept` variants against private objects; diff route tables and controllers between API versions to find endpoints present in the old but not the new; test alternate subdomains; for each ingestion path, confirm policy checks run. Confirm deprecated endpoints are removed, not just unlinked.

## Variants seen
- Legacy customer-data API left reachable after replacement [E2](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-11-optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-disclo.md)
- JS embed template for private snippets bypassing the `public_snippet?` view check [E3](https://bugbountylibrary.com/r/h1%3A348443.md)
- Channel JSON endpoint skipping storefront password and product-visibility checks [E4](https://bugbountylibrary.com/r/h1%3A93394.md)
- JSON renderer omitting the HTML path's authorization check [E5](https://bugbountylibrary.com/r/h1%3A1424291.md)
- Pages artifact preview domain skipping the group IP allowlist [E6](https://bugbountylibrary.com/r/h1%3A1591412.md)
- Email-to-MR path applying patches without push-rule pre-checks [E7](https://bugbountylibrary.com/r/h1%3A526570.md)

## Why fixes fail
Swapping to a new endpoint without removing the old one leaves the exposure live [E2](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-11-optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-disclo.md). Gating only the view or only the primary route leaves format variants and legacy paths open [E3](https://bugbountylibrary.com/r/h1%3A348443.md)[E5](https://bugbountylibrary.com/r/h1%3A1424291.md). Unlinking a feature is not removing it.

## Impact and severity
Bulk PII disclosure for ~10,000 records [E2](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-11-optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-disclo.md), private content read cross-origin [E3](https://bugbountylibrary.com/r/h1%3A348443.md), unpublished product data exposed unauthenticated [E4](https://bugbountylibrary.com/r/h1%3A93394.md), private media read by ID [E5](https://bugbountylibrary.com/r/h1%3A1424291.md), IP-allowlist bypass leaking artifacts [E6](https://bugbountylibrary.com/r/h1%3A1591412.md), and push-rule bypass allowing prohibited commits [E7](https://bugbountylibrary.com/r/h1%3A526570.md). Severity rises with enumerable identifiers, which turn a single-object leak into mass disclosure [E2](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-11-optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-disclo.md).

Adjacent, not this pattern: proxy ACL pipelines skipped by synthesized internal requests (URN->HTTP) [E1](https://bugbountylibrary.com/r/h1%3A824802.md); that is a protocol-handler variant of the same root cause but not object authorization, and its RCE chain is out of scope here.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A824802.md
- E2: https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-11-optimizing-hunting-results-in-vdp-for-use-in-bug-bounty-programs-from-sensitive-information-disclo.md
- E3: https://bugbountylibrary.com/r/h1%3A348443.md
- E4: https://bugbountylibrary.com/r/h1%3A93394.md
- E5: https://bugbountylibrary.com/r/h1%3A1424291.md
- E6: https://bugbountylibrary.com/r/h1%3A1591412.md
- E7: https://bugbountylibrary.com/r/h1%3A526570.md