# Client-side-only authorization checks

Privileged action gated only in UI; backend endpoint accepts it without its own server-side check

_Area: Web access control and IDOR. Seen in 7 disclosed reports; 2 confirmed bounties: $150 and $1,500; latest 2026-07-15. Updated 2026-10-23._

## How it works
The system assumes that if the client hides or blocks an action, the action cannot happen. The real trust boundary is the server, but the permission decision lives in the UI, the embedded viewer, or a sibling product's flow. The endpoint behind the button has no check of its own, so any caller reaching it directly — with their own valid low-privilege credentials — gets the privileged result. The broken assumption: "the client is the only caller, and it enforces the rule." A close cousin: the server does check, but trusts a client-supplied value (a permission flag, an entitlement boolean, a token) as the basis for that check.

## Where it shows up
- Permission logic in client code: hardcoded permission strings, helpers that block an action locally, dialogs that hide controls [E6](https://bugbountylibrary.com/r/h1%3A827816.md).
- Shared backend endpoints serving multiple product variants or hosts, where only one variant's UI enforces a restriction [E1](https://bugbountylibrary.com/r/h1%3A1758174.md).
- Feature flags (hide-download, secure-view) enforced in the viewer but not at the file/API endpoint [E2](https://bugbountylibrary.com/r/h1%3A1194606.md).
- Access tokens or session URLs exposed to the client that grant backend read access directly [E2](https://bugbountylibrary.com/r/h1%3A1194606.md).
- Request-schema fields the UI never sends (unmask/reveal/admin/debug booleans) that the backend honors [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-business-logic.md).
- Chat slash-commands or websocket events mapping to privileged actions, gated only in dispatch code [E4](https://bugbountylibrary.com/r/h1%3A1987011.md).
- Embedded webviews whose navigation crosses into admin routes trusting the device session [E5](https://bugbountylibrary.com/r/h1%3A985150.md).

## How to review
For every privileged action, locate the server-side check that authorizes it, independent of which client called it. The invariant: the backend must verify the caller's role/tenant/permission on each request from server-held state, not from anything the client controls or omits. Ask: does the endpoint re-check role/tenant/token scope itself, or does it trust a flag, token, or UI flow? Distinguish two cases. Missing authz: no server check exists at all — the endpoint acts on any authenticated caller [E1](https://bugbountylibrary.com/r/h1%3A1758174.md)[E4](https://bugbountylibrary.com/r/h1%3A1987011.md). Wrong layer: a check exists but reads client-supplied state — a boolean in the request body [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-business-logic.md), or a permission flag echoed back from the client [E6](https://bugbountylibrary.com/r/h1%3A827816.md). If the only gate is a client dialog, flag, hidden field, or UI flow, it is unsafe.

## Variants seen
- Multi-tenant/product: signup restriction enforced in one host's UI, shared `createTeam` API accepted it for the restricted host [E1](https://bugbountylibrary.com/r/h1%3A1758174.md).
- Embedded viewer: hide-download enforced in UI, but the WOPI token in the client URL carried full read scope to the endpoint — partly token exposure, not purely UI gating [E2](https://bugbountylibrary.com/r/h1%3A1194606.md).
- Client-controlled entitlement boolean honored by backend [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-business-logic.md).
- Websocket/chat command bypassing room access rules [E4](https://bugbountylibrary.com/r/h1%3A1987011.md).
- Webview navigation crossing into admin settings [E5](https://bugbountylibrary.com/r/h1%3A985150.md).
- Client-trusted permission flags in an API response [E6](https://bugbountylibrary.com/r/h1%3A827816.md).

## Impact and severity
Cross-role and cross-tenant access: self-provisioning a restricted workspace [E1](https://bugbountylibrary.com/r/h1%3A1758174.md), downloading protected files [E2](https://bugbountylibrary.com/r/h1%3A1194606.md), unmasking contact data at scale [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-business-logic.md), spawning objects in restricted rooms [E4](https://bugbountylibrary.com/r/h1%3A1987011.md), reaching store-owner settings [E5](https://bugbountylibrary.com/r/h1%3A985150.md), and board takeover [E6](https://bugbountylibrary.com/r/h1%3A827816.md). Severity rises with data sensitivity, whether the action is read or write, and shared endpoints or leaked tokens that widen reach.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1758174.md
- E2: https://bugbountylibrary.com/r/h1%3A1194606.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-business-logic.md
- E4: https://bugbountylibrary.com/r/h1%3A1987011.md
- E5: https://bugbountylibrary.com/r/h1%3A985150.md
- E6: https://bugbountylibrary.com/r/h1%3A827816.md