# Child object ignores parent visibility

Child authorized on its own flag or caller context, never on parent or source visibility

_Area: Web access control and IDOR. Seen in 10 disclosed reports; 5 confirmed bounties, median $1,337, range $256-$2,500; latest 2026-10-10. Updated 2026-10-23._

## How it works
A child object (comment, topic, note, album result, notification) is authorized against its own status, or against a context the caller controls, while the visibility of its parent or source object is never consulted. Two terms: the **parent** is the object the child hangs off (forum, project, snippet, album owner); the **source** is a context object used in a comparison, which must be server-derived. The broken assumption: that a child's own flag or the caller's supplied context fully determines who may see it. When the parent is private, the child still resolves as public.

## Where it shows up
- Visibility helpers with an optional "check ancestors" flag passed as false [E4](https://bugbountylibrary.com/r/h1%3A4053546.md)
- Finder/query branches returning unscoped `.all` for one type discriminator while siblings scope by project [E2](https://bugbountylibrary.com/r/h1%3A1751258.md)
- Access checks comparing a target to a "source" context taken from a request parameter [E3](https://bugbountylibrary.com/r/h1%3A312647.md)
- State-changing endpoints (like/favorite/vote) that echo the acted-on object [E5](https://bugbountylibrary.com/r/h1%3A1694304.md)[E7](https://bugbountylibrary.com/r/h1%3A2541962.md)
- Search helpers that take a target userId but read config from the ambient session user [E6](https://bugbountylibrary.com/r/h1%3A3506873.md)
- Role changes that auto-create subscriptions to objects the role cannot read [E8](https://bugbountylibrary.com/r/h1%3A2552205.md)
- Embedded widgets running with the victim's session and exposing data via postMessage [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md)

## How to review
For every child read or write, trace authorization to the parent/source object, not just the child's own flag. Invariant: a child is visible only if the caller can see its parent, and any "source" context in a comparison must be server-derived. Grep call sites of visibility helpers for disabled ancestor checks [E4](https://bugbountylibrary.com/r/h1%3A4053546.md); inspect finder branches for unscoped `.all` [E2](https://bugbountylibrary.com/r/h1%3A1751258.md); confirm the source context is not a request parameter [E3](https://bugbountylibrary.com/r/h1%3A312647.md); check that search helpers operating on another user's folder read that user's config, not the session user's [E6](https://bugbountylibrary.com/r/h1%3A3506873.md); confirm notification/subscription paths re-check read permission [E8](https://bugbountylibrary.com/r/h1%3A2552205.md); treat the victim session as the source context for embedded widgets [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md).

## Variants seen
- Public subforum under private parent leaks via activity stream [E4](https://bugbountylibrary.com/r/h1%3A4053546.md)
- Type discriminator flips finder to unscoped branch [E2](https://bugbountylibrary.com/r/h1%3A1751258.md)
- Attacker-supplied source_topic_id passes category check [E3](https://bugbountylibrary.com/r/h1%3A312647.md)
- Like endpoint returns hidden comment content [E7](https://bugbountylibrary.com/r/h1%3A2541962.md)
- Viewer's source-folder config overrides album owner's scope [E6](https://bugbountylibrary.com/r/h1%3A3506873.md)
- Viewer role auto-subscribes to draft reports [E8](https://bugbountylibrary.com/r/h1%3A2552205.md)
- Embedded player exposes private playlists to embedding page [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md)
- Missing membership check on like, then export renders the tweet [E5](https://bugbountylibrary.com/r/h1%3A1694304.md)

## Why fixes fail
E8: the leak came through the notification pipeline, so fixing the direct read path alone would not stop it; the subscription itself had to be removed. E5: the write was accepted, so the leak surfaced later in the data-export read path.

## Impact and severity
Private content disclosure: staff topics, private snippets, hidden comments, draft reports, watch history, files outside an album's scope. Median bounty 1169 (range 256-2500), 6 of 11 paid. Worse when the leak reaches many users via notifications [E8](https://bugbountylibrary.com/r/h1%3A2552205.md) or persists through a session-bound widget [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md
- E2: https://bugbountylibrary.com/r/h1%3A1751258.md
- E3: https://bugbountylibrary.com/r/h1%3A312647.md
- E4: https://bugbountylibrary.com/r/h1%3A4053546.md
- E5: https://bugbountylibrary.com/r/h1%3A1694304.md
- E6: https://bugbountylibrary.com/r/h1%3A3506873.md
- E7: https://bugbountylibrary.com/r/h1%3A2541962.md
- E8: https://bugbountylibrary.com/r/h1%3A2552205.md