# Field-level authorization missing in serializers

Responses serializing whole models or joined records, exposing tokens, emails, PINs, or unauthorized targets

_Area: Web access control and IDOR. Seen in 8 disclosed reports; 3 confirmed bounties, median $12,000, range $1,500-$12,500; latest 2025-04-01. Updated 2026-10-23._

## How it works
An access check is applied to the object or operation, but not to each field or to the specific target being resolved. The code confirms the caller may reach the object, then serializes the whole model or echoes back a joined record, so private fields (tokens, emails, PINs) or unauthorized targets ride along. The broken assumption: "can access the object" equals "can see every field on it," and "the UI hides it" equals "the API refuses it." Invariant: authorization is enforced per field and per resolved target, not just per top-level query.

## Where it shows up
- Serializers/resolvers emitting full models, including token or encrypted-token columns, into responses [E1](https://bugbountylibrary.com/r/h1%3A509924.md).
- Mutations echoing back input objects with joined user records, exposing pending-invite emails [E4](https://bugbountylibrary.com/r/h1%3A2032716.md).
- GraphQL nodes returning an id to a low-privilege user where field selection can be expanded [E3](https://bugbountylibrary.com/r/h1%3A882412.md).
- Tokens whose scope string is broader than the user's UI permissions, reaching sensitive scalar fields [E7](https://bugbountylibrary.com/r/h1%3A1091303.md).
- Parallel JSON/API representations of a public page that skip view-layer redaction [E6](https://bugbountylibrary.com/r/h1%3A3000510.md).
- REST endpoints reusing models that include fields the UI hides [E8](https://bugbountylibrary.com/r/h1%3A962462.md).
- Privacy ACLs lost when an object migrates from REST to GraphQL [E2](https://bugbountylibrary.com/r/h1%3A792927.md).

## How to review
For every response, ask: which fields does the caller's role permit, and does the serializer filter to exactly those? Concrete checks: diff each serializer's field list against the role matrix; replay the mutation with an expanded GraphQL selection and compare to the UI; capture the raw mutation response when inviting/adding users to catch over-returned joined records [E4](https://bugbountylibrary.com/r/h1%3A2032716.md); request the .json/API variant of a public page and diff fields against the HTML [E6](https://bugbountylibrary.com/r/h1%3A3000510.md); compare a token's scope string to the user's actual permissions [E7](https://bugbountylibrary.com/r/h1%3A1091303.md); re-test field ACLs after REST-to-GraphQL migrations [E2](https://bugbountylibrary.com/r/h1%3A792927.md). Capture raw responses, not UI output.

## Variants seen
- Quick Action resolving an arbitrary target project and serializing its runner tokens — both missing target-level authz and full-model serialization [E1](https://bugbountylibrary.com/r/h1%3A509924.md).
- Mutation over-returning joined collaborator emails before invite acceptance [E4](https://bugbountylibrary.com/r/h1%3A2032716.md).
- Per-field authorization absent on an order node [E3](https://bugbountylibrary.com/r/h1%3A882412.md).
- Broad POS token scope exposing staff PINs [E7](https://bugbountylibrary.com/r/h1%3A1091303.md).
- JSON endpoint serializing full reporter object with OTP codes and secret token [E6](https://bugbountylibrary.com/r/h1%3A3000510.md).
- REST serializer exposing schedule variable values the UI restricts [E8](https://bugbountylibrary.com/r/h1%3A962462.md).
- GraphQL migration dropping the email-hiding ACL [E2](https://bugbountylibrary.com/r/h1%3A792927.md).

## Impact and severity
Leaked runner tokens, private emails, full order details, staff PINs, OTP backup codes, and pipeline secrets. Severity rose where leaked secrets granted further access (tokens, PINs, OTP codes) or where enumeration scaled the leak to any user.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A509924.md
- E2: https://bugbountylibrary.com/r/h1%3A792927.md
- E3: https://bugbountylibrary.com/r/h1%3A882412.md
- E4: https://bugbountylibrary.com/r/h1%3A2032716.md
- E5: https://bugbountylibrary.com/r/h1%3A762271.md
- E6: https://bugbountylibrary.com/r/h1%3A3000510.md
- E7: https://bugbountylibrary.com/r/h1%3A1091303.md
- E8: https://bugbountylibrary.com/r/h1%3A962462.md