# Cross-endpoint identifier resolution without authorization

An ID from one product accepted by an unrelated RPC that resolves it without checking ownership or current membership

_Area: Web access control and IDOR. Seen in 3 disclosed reports; 2 confirmed bounties: $1,337 and $10,633; latest 2026-04-14. Updated 2026-10-23._

## How it works
An identifier minted or exposed by one resource type (a channel's Gaia ID, a global record gid, a space ID) is accepted by a different endpoint that resolves it to data. The resolving endpoint trusts the identifier itself as proof of access, so it never re-checks that the caller owns the record, belongs to the tenant, or is still a member. The assumption that breaks: that an ID only reaches endpoints where the caller is already authorized. In practice IDs leak from one product and are happily resolved by another [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-leaking-youtube-emails.md)[E2](https://bugbountylibrary.com/r/h1%3A3543475.md)[E3](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20221201043429-https-hopesamples-blogspot-com-2022-11-the-space-creators-can-still-see-html.md).

## Where it shows up
- Endpoints that take an opaque ID and return resolved attributes (email, name, attachment) rather than acting on the caller's own records [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-leaking-youtube-emails.md).
- Parallel import/export or read/write paths sharing signed-reference logic, where one sibling checks ownership and the other does not [E2](https://bugbountylibrary.com/r/h1%3A3543475.md).
- Role-based checks (creator/manager) that persist after membership is removed [E3](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20221201043429-https-hopesamples-blogspot-com-2022-11-the-space-creators-can-still-see-html.md).
- Base64 protobuf params and discovery docs exposing internal identifiers that legacy RPCs still resolve [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-leaking-youtube-emails.md).

## How to review
For every endpoint that accepts an identifier, find where the record is loaded and confirm an explicit ownership/tenant/membership check runs on that loaded record before any field is returned or written. The invariant: resolved record's owner (account_id, current membership, tenant) must equal the caller's, checked at resolution time, not inferred from the ID or a historical role. Diff sibling paths for the same signed-reference logic and confirm both enforce the check [E2](https://bugbountylibrary.com/r/h1%3A3543475.md). For role-gated RPCs, verify the check reads current membership, not a stored creator flag [E3](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20221201043429-https-hopesamples-blogspot-com-2022-11-the-space-creators-can-still-see-html.md).

## Variants seen
- Cross-product ID resolution: one endpoint leaks an internal ID, an unrelated RPC resolves it to PII [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-leaking-youtube-emails.md).
- Cross-tenant signed-reference minting: import path mints references for foreign records without tenant check [E2](https://bugbountylibrary.com/r/h1%3A3543475.md).
- Stale role authorization: removed creator retains member-listing access via space ID [E3](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20221201043429-https-hopesamples-blogspot-com-2022-11-the-space-creators-can-still-see-html.md).

## Impact and severity
Deanonymization of any user's email [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-leaking-youtube-emails.md), cross-tenant attachment disclosure [E2](https://bugbountylibrary.com/r/h1%3A3543475.md), and member PII exposure after removal [E3](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20221201043429-https-hopesamples-blogspot-com-2022-11-the-space-creators-can-still-see-html.md). Severity rises when the resolving endpoint returns PII directly in its response and when the identifier is broadly obtainable, making the flaw affect all users rather than one tenant.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-leaking-youtube-emails.md
- E2: https://bugbountylibrary.com/r/h1%3A3543475.md
- E3: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20221201043429-https-hopesamples-blogspot-com-2022-11-the-space-creators-can-still-see-html.md