# Client-supplied actor identity trusted

Endpoints taking actor, owner, tenant or role id from the request instead of binding it to the session

_Area: Web access control and IDOR. Seen in 17 disclosed reports; 11 confirmed bounties, median $2,000, range $300-$20,000; latest 2026-10-21. Updated 2026-10-23._

## How it works

The server must know *who* is acting and *what they may touch*. Instead of deriving that from the authenticated session, it reads an identifier (profile_id, ownerId, userUuid, wallet_id, teamId, a role field, or an identity header) from the request body, URL, or a serialized blob, and acts on it. The broken assumption: that the client only sends its own identity, or one it is entitled to act for. Nothing enforces that, so a caller can name another party and the server performs the action as if that party had asked. The fix is to derive the actor from the session and reject a request id that disagrees; where the action is gated by invite or OTP state, the id must be bound to that server-side state.

Two close relatives share the root cause: authorization reads ownership from the *submitted* object (labels, body fields) while the object actually mutated is chosen by the URL, and nothing binds the two [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md); and a lookup endpoint takes an object identifier and returns data without checking the caller may see that object (object-level authz) [E2](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md).

## Where it shows up

- Mutations/endpoints with `owner`, `actor`, `user_id`, `profile_id`, `wallet_id`, `teamId` in body/query/variables.
- Verification flows (phone/email) where the account id is a request parameter and only the code is checked [E1](https://bugbountylibrary.com/r/blog%3Awhitton-io-articles-hijacking-a-facebook-account-with-sms.md).
- Lookup/RPC endpoints taking a user identifier and returning profile or credential data [E2](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md).
- Account-linking fields (uid, external_id) in profile updates [E4](https://bugbountylibrary.com/r/h1%3A674195.md).
- Multi-tenant signup where the tenant id is a request parameter rather than bound to invite/OTP state [E7](https://bugbountylibrary.com/r/h1%3A1716016.md).
- Email/identity-change endpoints trusting an account id in the URL [E8](https://bugbountylibrary.com/r/h1%3A1685970.md).
- Encoded blobs (base64) carrying a trusted recipient/owner field the server does not verify [E3](https://bugbountylibrary.com/r/blog%3Aavatao-com-blog-how-i-could-have-stolen-your-photos-from-google-my-first-3-bug-bounty-writeups.md).
- Proxies that append rather than replace identity headers (X-Remote-User/Group) [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w2-fgvx-vhv4.md).
- Endpoints authorizing on body-supplied ownership labels but mutating by URL path [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md).

## How to review

The invariant: every identifier that determines *whose* data is read or written, *what role* the actor holds, or *which object* is mutated must be derived server-side from the session, or explicitly checked against it. For each such field ask: if I replace this value with another user's/tenant's id, does the server reject it? For label-based authz, confirm ownership labels are read from the *stored* object, not the submitted one, and that the URL-selected object is the one authorized [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md). For lookups, confirm the resolved object's ownership is checked, not just that the identifier is valid [E2](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md). For proxies, confirm inbound identity headers are stripped, not appended [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w2-fgvx-vhv4.md). For encoded blobs, confirm every trusted field is validated server-side [E3](https://bugbountylibrary.com/r/blog%3Aavatao-com-blog-how-i-could-have-stolen-your-photos-from-google-my-first-3-bug-bounty-writeups.md). Test: replay with a second valid session's id and confirm rejection.

## Variants seen

- Account-linking via client profile_id on verification endpoint [E1](https://bugbountylibrary.com/r/blog%3Awhitton-io-articles-hijacking-a-facebook-account-with-sms.md).
- Lookup RPC returning a token for an arbitrary userUuid (object-level authz) [E2](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md).
- Encoded request blob carrying an unverified recipient email [E3](https://bugbountylibrary.com/r/blog%3Aavatao-com-blog-how-i-could-have-stolen-your-photos-from-google-my-first-3-bug-bounty-writeups.md).
- Profile update rebinding uid to another identity [E4](https://bugbountylibrary.com/r/h1%3A674195.md).
- Signup trusting a swapped team id instead of invite context [E7](https://bugbountylibrary.com/r/h1%3A1716016.md).
- Email change trusting URL account number [E8](https://bugbountylibrary.com/r/h1%3A1685970.md).
- Proxy appending forged identity headers [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w2-fgvx-vhv4.md).
- Authz on body labels, mutation by URL path [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md).

## Impact and severity

Led to account takeover [E1](https://bugbountylibrary.com/r/blog%3Awhitton-io-articles-hijacking-a-facebook-account-with-sms.md)[E2](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md)[E4](https://bugbountylibrary.com/r/h1%3A674195.md)[E8](https://bugbountylibrary.com/r/h1%3A1685970.md), cross-tenant workspace access [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w2-fgvx-vhv4.md)[E7](https://bugbountylibrary.com/r/h1%3A1716016.md), and cross-project takeover of workflow runs [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md). Severity rises when the trusted field gates credentials or cross-tenant boundaries; worse when the action is silent (no victim approval) and scriptable.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awhitton-io-articles-hijacking-a-facebook-account-with-sms.md
- E2: https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md
- E3: https://bugbountylibrary.com/r/blog%3Aavatao-com-blog-how-i-could-have-stolen-your-photos-from-google-my-first-3-bug-bounty-writeups.md
- E4: https://bugbountylibrary.com/r/h1%3A674195.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-46r4-q7wv-32fc.md
- E6: https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w2-fgvx-vhv4.md
- E7: https://bugbountylibrary.com/r/h1%3A1716016.md
- E8: https://bugbountylibrary.com/r/h1%3A1685970.md