# Alternate path skips authorization

Second ingestion, scripting, dedupe or subrequest path reaching protected data without the primary path's check

_Area: Web access control and IDOR. Seen in 4 disclosed reports; latest 2026-07-16. Updated 2026-10-24._

## How it works
A resource is protected on its main path, but a second path reaches the same data or action and never runs that check. The broken assumption is that all access flows through the guarded path. Dedupe short-circuits, patch ingestion, script engines and internal subrequests each re-implement access, and each can omit the check the primary path enforces.

## Where it shows up
- Content-addressed storage where the object key is global but authorization is per-tenant; look at every branch that creates the tenant binding [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)
- Early returns before integrity or ownership checks (dedupe, "already exists", cache hit) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)
- Multiple ingestion routes into one repo: git push vs email patch vs API import [E2](https://bugbountylibrary.com/r/h1%3A526570.md)
- Scripting or query languages (js, polyglot) that bypass the SQL/Cypher authorization layer [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-48qw-824m-86pr.md)
- Framework listeners that skip subrequests, combined with a request-controlled path parameter [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-6h46-9jf5-q59x.md)
- Policy checks (push rules, access_control) applied in one handler only

## How to review
For each protected resource, enumerate every path that reads or writes it, then confirm each one runs the same authorization decision. The invariant: authorization is bound to the (principal, tenant, resource) tuple at the point of access, not to the entry route. Specifically:
- Does any branch return success before verifying the caller owns the claimed key? [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)
- Does the secondary ingestion path invoke the same policy pre-check as the primary? [E2](https://bugbountylibrary.com/r/h1%3A526570.md)
- Does the script/query engine pass through the same authz as standard queries, and can a bound object reach a ClassLoader? [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-48qw-824m-86pr.md)
- Can a request parameter become a subrequest target, and do security listeners run on subrequests? [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-6h46-9jf5-q59x.md)

## Variants seen
- Dedupe branch skips hash/ownership check, binding a foreign OID [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)
- Email-to-MR patch application skips push-rule pre-check [E2](https://bugbountylibrary.com/r/h1%3A526570.md)
- Scripting language skips DB authz and escapes sandbox via reflection [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-48qw-824m-86pr.md)
- Attacker-controlled _failure_path becomes a subrequest that bypasses the firewall [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-6h46-9jf5-q59x.md)

## Impact and severity
Cross-tenant private data disclosure [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md), policy bypass allowing unsigned commits and secrets [E2](https://bugbountylibrary.com/r/h1%3A526570.md), arbitrary host file read and privilege escalation from a reader role [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-48qw-824m-86pr.md), unauthenticated access to protected routes [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-6h46-9jf5-q59x.md). Severity rises when the alternate path is reachable by low-privilege or unauthenticated users and when it crosses tenant boundaries.

## Why fixes fail
Fixing only the primary path leaves the alternate route open; each new ingestion or scripting path must be audited against the same invariant, and sandbox allowlists fail when any bound object exposes getClass() [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-48qw-824m-86pr.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md
- E2: https://bugbountylibrary.com/r/h1%3A526570.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-48qw-824m-86pr.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-6h46-9jf5-q59x.md