# Denylist misses I/O or getter accessors

Method or function denylists that omit read verbs, getters, or whole I/O families

_Area: Web access control and IDOR. Seen in 3 disclosed reports; latest 2026-09-17. Updated 2026-11-07._

## How it works
A security control lists what is forbidden (or allowed) by name, and the list is incomplete. The assumption that breaks is "we enumerated every dangerous accessor." Denylists miss the read verb, the getter, or sibling functions in the same family. Allowlists miss the parent class's separate entry or the raw accessor behind a redacting serializer. Either way, a method the author never considered reaches the same data the control was meant to protect.

## Where it shows up
- Authorization helpers that filter by HTTP method and name only PUT/PATCH/DELETE/POST, leaving GET [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gh4-jmwq-rr8w.md)
- Sandbox/allowlist policies naming `offsetGet`/`offsetExists`/`get`/`value` on objects whose `jsonSerialize()` strips secrets [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jhr-mxmx-38cx.md)
- A parent class with its own allowlist entry (`instanceof` match) granting the same access [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jhr-mxmx-38cx.md)
- ORM fields holding tokens or secrets without `secret=True`, so `exclude_secrets` does not strip them [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gh4-jmwq-rr8w.md)
- SQL validators using a regex denylist of a few function names while the engine exposes a whole I/O family [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p2j4-c4g6-rpf5.md)
- RBAC extraction that only parses FROM/JOIN, ignoring scalar table functions in the SELECT list [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p2j4-c4g6-rpf5.md)

## How to review
Find every place access is gated by an enumerated list. For each, ask: is this a denylist (what does it omit?) or an allowlist (what does it over-grant?). The invariant: the control must cover the full set of accessors that reach the protected data, including read verbs, getters, parent-class entries, and every function in an I/O family. For redaction, verify the accessor path returns the same redacted view as the serializer, not raw fields. For ORM, confirm secret fields are marked secret, not merely excluded by convention. For SQL, confirm RBAC applies to raw paths and table functions, not just FROM/JOIN tables.

## How finders spotted it
- Read the sandbox policy, saw raw data-access methods allow-listed on a class whose `jsonSerialize()` strips secrets, then checked the parent allowlist for a second path [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jhr-mxmx-38cx.md)
- Read `superuser_validators`, noticed the method check was a denylist missing GET, then checked the token field lacked `secret=True` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gh4-jmwq-rr8w.md)
- Noticed the validator regex named only two functions and RBAC only inspected FROM/JOIN, then tried other I/O functions in the SELECT list [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p2j4-c4g6-rpf5.md)

## Variants seen
- Sandbox allowlist over-granting getters on a redacting object [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jhr-mxmx-38cx.md)
- Method denylist omitting the read verb on a credential-bearing table [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gh4-jmwq-rr8w.md)
- Function denylist missing the I/O family, plus RBAC scope limited to FROM/JOIN [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p2j4-c4g6-rpf5.md)

## Impact and severity
E1 leaked hashed passwords and 2FA seeds; seed disclosure escalates to authentication bypass and scales site-wide if binding resolves arbitrary users [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jhr-mxmx-38cx.md). E2 gave admin-to-superuser escalation: full table read/write/delete, session revocation, password changes, CSV export [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gh4-jmwq-rr8w.md). E3 gave arbitrary local-file read, cross-tenant access, and SSRF to cloud metadata [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p2j4-c4g6-rpf5.md). Severity rises when the leaked material is a credential or seed, and when the control's scope (table layer, session user) is narrower than the data it guards.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **getgrav/grav (composer)** <= 2.0.15, fixed in 2.0.16: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password (CVE-2026-76839). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-3jhr-mxmx-38cx.md
- **piccolo-admin (pip)** <= 1.13.0, fixed in 1.14.0: piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sess (CVE-2026-55485). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-2gh4-jmwq-rr8w.md. Fix: https://github.com/piccolo-orm/piccolo_admin/commit/96ddae12baf12288056cbb0cda6f9e8d7e22c86d
- **github.com/basekick-labs/arc (go)** < 0.0.0-20260520141557-91bdc29d1a02, fixed in 0.0.0-20260520141557-91bdc29d1a02: Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks (CVE-2026-47735). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-p2j4-c4g6-rpf5.md. Fix: https://github.com/Basekick-Labs/arc/commit/91bdc29d1a02178ccf8c66375eccf85203108dfb

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-3jhr-mxmx-38cx.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-2gh4-jmwq-rr8w.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-p2j4-c4g6-rpf5.md