# Client-supplied permission signal trusted

Server re-derives identity and rights from its own state, not from client-sent session, secret, or permission values.

_Area: Web access control and IDOR. Seen in 3 disclosed reports; one confirmed bounty: $500; latest 2026-10-19. Updated 2026-10-23._

## How it works
A privileged decision is made from a value the client can supply or influence, instead of being re-derived server-side from the authenticated principal. The assumption that breaks: that a session, credential, shared secret, or permission field arriving in a request reflects the caller's real authority. In practice the value may belong to another user, be inherited from earlier state on the same thread, or be minted by the attacker's own instance.

## Where it shows up
- Frameworks that batch RPC calls on one thread, where an earlier call mutates thread-local context (session, user, tenant) [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed.md)
- Pre-auth-whitelisted methods that internally call privileged loaders [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed.md)
- Credential persistence keyed by user but written from the acting session without an owner check [E2](https://bugbountylibrary.com/r/h1%3A1061591.md)
- Notification or callback handlers that mutate permissions, authenticated only by a shared secret the recipient already holds [E3](https://bugbountylibrary.com/r/h1%3A1990443.md)
- Any endpoint accepting a permission, role, tenant, or session field from the request body

## How to review
Trace every authorization decision to its source. The invariant: identity and rights must be re-derived from server-side state bound to the authenticated principal, never read from client input or inherited thread/context state. Check that (a) batched or sequential calls cannot leak context between calls [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed.md); (b) persisted credentials are written only for the session's own user [E2](https://bugbountylibrary.com/r/h1%3A1061591.md); (c) permission-changing messages are validated against the sender's actual grant authority, not just possession of a secret [E3](https://bugbountylibrary.com/r/h1%3A1990443.md).

## Variants seen
- Thread-local session set by a pre-auth method, trusted by a later call in the same batch [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed.md)
- Session credentials persisted for the wrong user during another user's context render [E2](https://bugbountylibrary.com/r/h1%3A1061591.md)
- Recipient-side trust of a client-crafted permission-change notification [E3](https://bugbountylibrary.com/r/h1%3A1990443.md)

## Impact and severity
Ranged from unauthenticated DB read and remote code execution [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed.md), to acting as another user [E2](https://bugbountylibrary.com/r/h1%3A1061591.md), to privilege escalation on a read-only share [E3](https://bugbountylibrary.com/r/h1%3A1990443.md). Severity rises when the trusted signal grants a system-level session [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed.md) or crosses tenant/user boundaries silently [E2](https://bugbountylibrary.com/r/h1%3A1061591.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed.md
- E2: https://bugbountylibrary.com/r/h1%3A1061591.md
- E3: https://bugbountylibrary.com/r/h1%3A1990443.md