# Missing object-level ownership check on IDs

Client-supplied IDs acted on without binding to the caller's identity or tenant

_Area: Web access control and IDOR. Seen in 5 disclosed reports; 3 confirmed bounties, median $6,500, range $500-$11,250; latest 2026-07-24. Updated 2026-10-24._

## How it works
The handler trusts an identifier the client sends (object ID, accountId, URN, UUID, tenant/session header) and acts on whatever it names. The broken assumption: that the caller only sends IDs they own or may see. Nothing ties the ID to the authenticated session, so any valid ID works. Authorization is often present but applied to the wrong thing — the action, one field, or the session header — while the target selector is left unchecked [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8vc-7pv3-g98p.md)[E6](https://bugbountylibrary.com/r/h1%3A1901713.md).

## Where it shows up
- Endpoints taking an object/account ID in body, path, or query with no ownership join to the session [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8vc-7pv3-g98p.md)[E6](https://bugbountylibrary.com/r/h1%3A1901713.md)
- Generic expand/decoration or URN-resolution mechanisms that resolve user-supplied strings server-side without per-field allowlisting [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)
- State-changing endpoints (like, favorite, crop, run) that echo the acted-on object back [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md)[E5](https://bugbountylibrary.com/r/h1%3A2541962.md)
- Lookup/RPC endpoints accepting a user UUID and returning profile or token fields [E3](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md)
- Workflows that session-check one identity field but take a separate target selector from the body [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8vc-7pv3-g98p.md)
- Multi-tenant consoles where a session/tenant header is trusted without checking the referenced resource's owner [E6](https://bugbountylibrary.com/r/h1%3A1901713.md)
- Search backends applying authorization to the primary document but not to joined/related objects [E7](https://bugbountylibrary.com/r/h1%3A710006.md)

## How to review
For every endpoint accepting an ID, trace where it is used and confirm a server-side check binds it to the caller: object owner equals session user, or resource tenant equals session tenant. The invariant: no read or mutation of a resource may proceed unless the authenticated principal is authorized for that specific resource, independent of which fields were validated. Check that visibility rules (hidden comments, unaccepted bids) gate the response, not just the action [E5](https://bugbountylibrary.com/r/h1%3A2541962.md). Verify error paths don't leak identifiers that feed other endpoints [E3](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md).

## Variants seen
- URN/decoration expansion resolving arbitrary email entities without per-field allowlist [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)
- Media-edit mutation on foreign videoID corrupting the object [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md)
- UUID leak in error message, then unauthenticated profile/token fetch [E3](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md)
- accountId taken from body while currentEmail is session-checked [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8vc-7pv3-g98p.md)
- Like endpoint returning hidden comment content [E5](https://bugbountylibrary.com/r/h1%3A2541962.md)
- Cross-tenant recovery via swapped session header [E6](https://bugbountylibrary.com/r/h1%3A1901713.md)
- Search scope returning private notes via unfiltered related objects [E7](https://bugbountylibrary.com/r/h1%3A710006.md)

## Impact and severity
Email database enumeration [E1](https://bugbountylibrary.com/r/h1%3A1806939.md), account takeover [E3](https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8vc-7pv3-g98p.md), cross-tenant data recovery [E6](https://bugbountylibrary.com/r/h1%3A1901713.md), destructive object corruption [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md), hidden-content disclosure [E5](https://bugbountylibrary.com/r/h1%3A2541962.md), and private metadata leakage [E7](https://bugbountylibrary.com/r/h1%3A710006.md). Severity rises with breadth of the ID space (sequential IDs), sensitivity returned (tokens, PII), and whether the action is destructive or persistent.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1806939.md
- E2: https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md
- E3: https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-c8vc-7pv3-g98p.md
- E5: https://bugbountylibrary.com/r/h1%3A2541962.md
- E6: https://bugbountylibrary.com/r/h1%3A1901713.md
- E7: https://bugbountylibrary.com/r/h1%3A710006.md