# Tenant scope omitted from queries

Queries, table lists, or guards that omit tenant scoping or pass on null equality

_Area: Web access control and IDOR. Seen in 3 disclosed reports; latest 2026-10-07. Updated 2026-10-30._

## How it works
Access control assumes every record has an owner or tenant and that the check compares that scope. The pattern breaks when the scope is missing or null. A guard like `a.gym != b.gym` returns False when both sides are None, so the forbidden branch never fires [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c72h-82w6-rqfp.md). A SQL layer can allow a table but forget to append its tenant filter [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2f4c-vrjq-rcgv.md). A backend can skip row-level security entirely, so any client key reads every row [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md). In each case the code looks guarded but the scope is absent.

## Where it shows up
- Equality or inequality guards on nullable scope fields (`!=`, `==`) where both sides can be None [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c72h-82w6-rqfp.md)
- Two separate allowlists: queryable tables vs. tenant-isolated tables [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2f4c-vrjq-rcgv.md)
- Querysets filtered only on a client-supplied ID with no tenant clause [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c72h-82w6-rqfp.md)
- Backends where row-level security is off or unverified, with keys shipped to clients [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md)
- Default-deny maps that omit tables added later [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2f4c-vrjq-rcgv.md)

## How to review
For every read or write, confirm the scope is enforced by the query itself, not only by a pre-check. The invariant: a request can only touch rows whose tenant/owner equals the caller's tenant, and a null or missing scope must deny, never match. Diff the queryable-table list against the tenant-isolated list; any table in the first but not the second is a bypass [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2f4c-vrjq-rcgv.md). For nullable scope fields, test with an account that has no tenant assigned [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c72h-82w6-rqfp.md). For hosted backends, query the REST/GraphQL endpoint directly with the client key and confirm it returns nothing [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md).

## Variants seen
- Null-equality guard bypass across five views, leaking notes, documents, contracts [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c72h-82w6-rqfp.md)
- SQL tool allowing tables that the tenant-isolation map omits [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2f4c-vrjq-rcgv.md)
- Row-level security disabled, exposing all tables via client key [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md)

## Impact and severity
Cross-tenant reads of PII, private messages, API keys, and contracts; in E3 full read/write over 1.5M keys and 35K emails. Severity is high to critical. Worse when keys are public, tables are numerous, or the guard is copied across many views [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-c72h-82w6-rqfp.md)[E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-c72h-82w6-rqfp.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-2f4c-vrjq-rcgv.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md