# Authorization checked on wrong subject

Authz keyed to a local row, flag, or object grant instead of the authoritative identity or global role

_Area: Web access control and IDOR. Seen in 3 disclosed reports; latest 2026-09-10. Updated 2026-10-31._

## How it works
An authorization decision is made against a proxy for the real resource rather than the resource itself. The check passes on a local database row, a PR flag, or a per-object grant, while the operation actually affects a different, shared, or higher-privileged object. The assumption that breaks: that the subject of the check is the same as the subject of the action. When a create/import path can mint a second local row aliasing the same external object, or a flag's privilege is evaluated against a different repo than the one written to, or a handler cascades into global config, the check answers the wrong question.

## Where to show up
- Authorization compares ownership of a local row, not the external resource identity [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-pxmc-2ffp-8j67.md)
- Create/import endpoints accept caller-supplied external IDs or bodies with no uniqueness constraint [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-pxmc-2ffp-8j67.md)
- Push/PR hooks that trust a PR flag; privilege evaluated against BASE vs HEAD repo [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm7c-rhg6-qr4r.md)
- Reverse-fork PRs where BASE=attacker, HEAD=victim [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm7c-rhg6-qr4r.md)
- A delete handler that performs a second operation on shared/global config [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2724-6cpj-gf3v.md)
- Sibling routes to the same config with weaker authz than the dedicated admin route [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2724-6cpj-gf3v.md)

## How to review
Identify the exact object the operation mutates, then confirm the check evaluates privilege against that same object. Invariant: the subject of the authorization check must be identical to the subject of the effect. For aliasing, verify a uniqueness constraint or identity binding prevents a second row from representing the same external object [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-pxmc-2ffp-8j67.md). For push hooks, confirm the write check targets the repo being written to, not the source [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm7c-rhg6-qr4r.md). For cascading deletes, confirm any global/shared side effect enforces the same role and in-use checks as the dedicated admin route [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2724-6cpj-gf3v.md).

## Variants seen
- Row-aliasing: duplicate record revokes victim's CA-side cert [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-pxmc-2ffp-8j67.md)
- Flag-trust inversion: allow-maintainer-edit authorizes upstream push via BASE check [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm7c-rhg6-qr4r.md)
- Cascade escalation: KB delete wipes shared admin-owned connection without role check [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2724-6cpj-gf3v.md)

## Impact and severity
Led to revocation of production certificates [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-pxmc-2ffp-8j67.md), unauthorized commits to any readable repo [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-mm7c-rhg6-qr4r.md), and destruction of shared admin-owned config breaking all dependent resources [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2724-6cpj-gf3v.md). Severity rises when the affected object is shared, global, or production-facing, and when no uniqueness or in-use check limits the blast radius.

## Why fixes fail
Partial fixes that add a check on the local row without binding external identity, or that guard the dedicated route but leave the weaker sibling, leave the wrong-subject gap open [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-pxmc-2ffp-8j67.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2724-6cpj-gf3v.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-pxmc-2ffp-8j67.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-mm7c-rhg6-qr4r.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-2724-6cpj-gf3v.md