# Tenant ID Not Scoped to Caller Handlers that authorize on session or one ID but act on a client-supplied tenant or parent ID. _Area: Web access control and IDOR. Seen in 9 disclosed reports; 6 confirmed bounties, median $935, range $100-$1,250; latest 2024-11-13. Updated 2026-10-23._ ## How it works A handler takes an object or tenant identifier from the request and authorizes against something else: the caller's session, their role in their own tenant, or a second parameter in the same request. The assumption that breaks is that the identifier in the request belongs to the caller's scope. It often doesn't, and the handler never checks. A valid low-privilege caller can then read or mutate another tenant's data by supplying that tenant's ID. Worked example: a caller holds an admin token for org A and sends `PUT /memberships/` where `` belongs to org B. The handler checks "is this caller an admin?" (true, in org A) but never checks "does `` belong to org A?" The authorization subject is the caller's org-A role; the target is an org-B membership. They diverge and nothing reconciles them [E1](https://bugbountylibrary.com/r/h1%3A809816.md). ## Where it shows up - Endpoints with two IDs in the signature (object ID plus tenant/app/parent ID) in path or body [E1](https://bugbountylibrary.com/r/h1%3A809816.md)[E4](https://bugbountylibrary.com/r/h1%3A43065.md) - Update/delete handlers where the role check keys off one parameter only [E1](https://bugbountylibrary.com/r/h1%3A809816.md)[E4](https://bugbountylibrary.com/r/h1%3A43065.md) - Moderation or curation actions keyed on a bare object ID [E2](https://bugbountylibrary.com/r/h1%3A1410498.md) - Create endpoints accepting a parent/owner reference [E3](https://bugbountylibrary.com/r/h1%3A1892200.md) - GraphQL mutations that check authentication but not per-object admin [E5](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-change-the-profanity-filter-for-any-facebook-page.md) - Recovery/run actions treated as a separate boundary from listing [E7](https://bugbountylibrary.com/r/h1%3A1901713.md) - Bulk actions whose ACL checks visibility rather than same-tenant ownership [E8](https://bugbountylibrary.com/r/h1%3A2516250.md) ## How to review For every handler, name the authorization subject (whose scope is checked) and the target (which object/tenant is acted on). The invariant: the target's owning tenant must equal the caller's authorized tenant, and the caller's role must be sufficient in that tenant. Derive the tenant used for the role check from the target object, not from the request body or the caller's token alone [E1](https://bugbountylibrary.com/r/h1%3A809816.md)[E7](https://bugbountylibrary.com/r/h1%3A1901713.md). Concrete diff step for two-ID handlers: take a request where both IDs belong to tenant A, then swap only the object ID to one from tenant B while keeping the tenant/app ID and token from A. If it succeeds, the object ID is not bound to the tenant. Then swap only the tenant ID. Verify each parameter independently, not just the pair [E4](https://bugbountylibrary.com/r/h1%3A43065.md). For create endpoints, verify access to any referenced parent/owner ID [E3](https://bugbountylibrary.com/r/h1%3A1892200.md). Diff sibling paths (import vs export, list vs run) for a missing check [E6](https://bugbountylibrary.com/r/h1%3A3543475.md)[E7](https://bugbountylibrary.com/r/h1%3A1901713.md). For bulk actions, require same-tenant ownership, not just view permission [E8](https://bugbountylibrary.com/r/h1%3A2516250.md). Check whether IDs are enumerable or leaked via list queries or page source, which widens exposure [E2](https://bugbountylibrary.com/r/h1%3A1410498.md)[E3](https://bugbountylibrary.com/r/h1%3A1892200.md). ## Variants seen - Privileged token from org A mutating membership IDs in org B [E1](https://bugbountylibrary.com/r/h1%3A809816.md) - Curation by bare comment ID leaking buyer data and mutating foreign comments [E2](https://bugbountylibrary.com/r/h1%3A1410498.md) - Child epic linked to a victim's parent_id across groups [E3](https://bugbountylibrary.com/r/h1%3A1892200.md) - Delete authorized on app_id but not account_id, cross-app deletion [E4](https://bugbountylibrary.com/r/h1%3A43065.md) - GraphQL mutation setting a page field without page-admin check [E5](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-change-the-profanity-filter-for-any-facebook-page.md) - Backup recovery authorized on session header, not machine/backup ownership (auth-subject confusion) [E7](https://bugbountylibrary.com/r/h1%3A1901713.md) - Duplicate-close ACL passing on view but not same-org ownership [E8](https://bugbountylibrary.com/r/h1%3A2516250.md) - Adjacent, not this pattern: signed-reference minting resolves IDs globally without an ownership check, unlike the export path [E6](https://bugbountylibrary.com/r/h1%3A3543475.md); orphaned integration re-binding is a confused-deputy issue, distinct from tenant-ID scoping. ## Impact and severity Led to organization takeover [E1](https://bugbountylibrary.com/r/h1%3A809816.md), cross-tenant data loss and DoS [E4](https://bugbountylibrary.com/r/h1%3A43065.md), PII leakage [E2](https://bugbountylibrary.com/r/h1%3A1410498.md), cross-tenant backup recovery [E7](https://bugbountylibrary.com/r/h1%3A1901713.md), and cross-org report disclosure [E8](https://bugbountylibrary.com/r/h1%3A2516250.md). Severity rises when the action grants admin, deletes data, or leaks bulk PII. Worse when IDs are enumerable or leaked through list queries or page source [E2](https://bugbountylibrary.com/r/h1%3A1410498.md)[E3](https://bugbountylibrary.com/r/h1%3A1892200.md). ## Evidence - E1: https://bugbountylibrary.com/r/h1%3A809816.md - E2: https://bugbountylibrary.com/r/h1%3A1410498.md - E3: https://bugbountylibrary.com/r/h1%3A1892200.md - E4: https://bugbountylibrary.com/r/h1%3A43065.md - E5: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-change-the-profanity-filter-for-any-facebook-page.md - E6: https://bugbountylibrary.com/r/h1%3A3543475.md - E7: https://bugbountylibrary.com/r/h1%3A1901713.md - E8: https://bugbountylibrary.com/r/h1%3A2516250.md