# Parent ID accepted without membership check

Handlers trusting parent, group, or tenant IDs from the request without verifying caller membership or ownership

_Area: Web access control and IDOR. Seen in 2 disclosed reports; one confirmed bounty: $1,160; latest 2026-06-23. Updated 2026-11-01._

## How it works
A handler receives a reference ID (parent epic, group, tenant, repo, OID) from the request and acts on it. The code checks that the caller may create or read the *child* object, but never checks that the caller has any relationship to the *referenced parent*. The assumption that breaks: that a client-supplied reference is one the caller is entitled to use. When storage or IDs are global while authorization is per-tenant, the gap between the two scopes is the bug [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)[E3](https://bugbountylibrary.com/r/h1%3A1892200.md).

## Where it shows up
- Create/update endpoints taking `parent_id`, `group_id`, `tenant_id`, `repo_id`, or an object OID straight from body or query [E3](https://bugbountylibrary.com/r/h1%3A1892200.md)[E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)
- Global IDs exposed in page source or public responses that can be swapped into requests [E3](https://bugbountylibrary.com/r/h1%3A1892200.md)
- Content-addressed storage (OID/hash keys) shared across tenants while bindings are per-tenant [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)
- Dedupe or short-circuit branches that return success before integrity/ownership checks [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)
- ORM query params (`attributes`, `include`) letting callers pull hidden columns or internal IDs [E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md)
- Guessable object-storage URLs for tenant files [E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md)

## How to review
For every request-supplied reference ID, trace to the authorization check and confirm it validates the caller's relationship to *that referenced object*, not just to the object being created. The invariant: a caller may only bind to a parent/tenant/OID they are a member of or own. Check that dedupe/short-circuit paths still verify the claimed key against the actual content and the caller's scope [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md). Check that ORM attribute/include params are allowlisted, not passed through [E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md). Check that file URLs are not the sole access control [E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md).

## Variants seen
- Cross-group parent linkage on epic create via arbitrary `parent_id` [E3](https://bugbountylibrary.com/r/h1%3A1892200.md)
- Global content-addressed LFS OID bound to a foreign repo through the dedupe branch [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)
- IDOR by swapping a public job ID to reach another company's data [E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md)
- Sequelize attribute injection leaking internal IDs, then chained [E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md)
- Unauthenticated GraphQL query and guessable S3 resume URLs [E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md)

## Impact and severity
Cross-tenant read of private content and PII (names, emails, phones, resumes) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md)[E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md), and injection of attacker content into a victim's group [E3](https://bugbountylibrary.com/r/h1%3A1892200.md). Severity rises with global ID exposure, unauthenticated endpoints, and guessable storage URLs, which turn a single missing check into bulk exposure [E2](https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-6p9m-q3jp-47h4.md
- E2: https://bugbountylibrary.com/r/blog%3Atech-blog-cymetrics-io-en-posts-huli-how-i-hacked-glints-and-your-resume-en.md
- E3: https://bugbountylibrary.com/r/h1%3A1892200.md