# Object ID without ownership check

Handlers that fetch or mutate by client-supplied id without binding the object to the caller

_Area: Web access control and IDOR. Seen in 39 disclosed reports; 26 confirmed bounties, median $2,700, range $100-$15,600; latest 2026-09-17. Updated 2026-10-23._

## How it works
A handler trusts the object identifier the client sends and looks the object up by that id alone. The code assumes that if the caller can name the object, the caller may touch it. Authentication (who you are) is checked; object-level authorization (whether this object is yours) is not. The lookup succeeds and the caller reads or changes data belonging to another user, role, or tenant. Two distinct shapes: a plain missing check, and a check that runs on one path while a downstream component assumes it already happened [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5.md).

## Where it shows up
- Fetch/mutate functions taking an id, uuid, tenant id, or global GraphQL id with no ownership predicate in the query.
- DB queries filtering only by object id, no membership JOIN or `$initiator`/owner parameter [E6](https://bugbountylibrary.com/r/h1%3A3484601.md).
- GraphQL `node(id:)` resolvers that check existence but not ownership [E3](https://bugbountylibrary.com/r/h1%3A2207248.md).
- Bulk or batch endpoints taking arrays of ids, where per-id access is never verified [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5.md)[E7](https://bugbountylibrary.com/r/h1%3A2513082.md).
- Upload/import endpoints keyed off a client-supplied migration or job id [E7](https://bugbountylibrary.com/r/h1%3A2513082.md).
- Auxiliary endpoints (scan, preview, image render, export) that skip permission checks the main read path enforces [E4](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2018-10-09-get-as-image-function-pulls-any-insights-nrql-data-from-any-new-relic-account-idor.md)[E5](https://bugbountylibrary.com/r/bc%3A5cb33ff7-4e4b-4f2a-b943-5fdc9c4f6f38.md).
- Endpoints carrying redundant identity fields (id, uuid, email) where a sentinel value like 0 acts as a wildcard [E8](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2023-06-the-unexpected-0-master-id-for-account-data-manipulation.md).

## How to review
For every endpoint accepting an object identifier, trace the id to the data layer and confirm the query or resolver binds the object to the authenticated caller. The invariant: an object is returned or mutated only if a check ties it to the caller's identity or role.
- Pick the binding matching the object type: owner-column check (`object.user_id == caller`) for user-owned objects, or tenant/scope check (`object.tenant_id IN caller.memberships`) for shared objects.
- GraphQL: open the `node(id:)` resolver and confirm it re-checks ownership, not just existence [E3](https://bugbountylibrary.com/r/h1%3A2207248.md).
- Bulk arrays: confirm the check runs per id inside the loop, not once on the request; a single guard before `for id in ids` is the bug shape [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5.md)[E7](https://bugbountylibrary.com/r/h1%3A2513082.md).
- Auxiliary routes: diff the auth middleware against the main read path; a missing account or permission check on the secondary route is the bug [E4](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2018-10-09-get-as-image-function-pulls-any-insights-nrql-data-from-any-new-relic-account-idor.md)[E5](https://bugbountylibrary.com/r/bc%3A5cb33ff7-4e4b-4f2a-b943-5fdc9c4f6f38.md).
- Code review: methods lacking an `$initiator` parameter and queries filtering only by object ids are strong signals [E6](https://bugbountylibrary.com/r/h1%3A3484601.md).
- Treat any 2xx or normal-looking payload for an object the caller does not own as a failure; silent success is the common shape [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5.md).

## Variants seen
- Bulk edit over id arrays with no per-id check; downstream trusts the check happened [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5.md).
- GraphQL global-id invoice lookup without shop binding [E3](https://bugbountylibrary.com/r/h1%3A2207248.md).
- Image/render endpoint skipping account validation the main API applies [E4](https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2018-10-09-get-as-image-function-pulls-any-insights-nrql-data-from-any-new-relic-account-idor.md).
- Scan endpoint missing channel permissions, returning foreign messages [E5](https://bugbountylibrary.com/r/bc%3A5cb33ff7-4e4b-4f2a-b943-5fdc9c4f6f38.md).
- Membership lookup by id with no initiator check [E6](https://bugbountylibrary.com/r/h1%3A3484601.md).
- Bulk action trusting a foreign `original_report_id` [E7](https://bugbountylibrary.com/r/h1%3A2513082.md).
- Sentinel id (0) treated as wildcard, bypassing the uuid check [E8](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2023-06-the-unexpected-0-master-id-for-account-data-manipulation.md).
- Media-edit mutation accepting a foreign video id, where malformed geometry input also corrupts the object [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md).

## Why fixes fail
Fixing one endpoint leaves sibling endpoints (scan, download, bulk, upload) unprotected [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5.md)[E7](https://bugbountylibrary.com/r/h1%3A2513082.md); the check must be centralized or repeated per path.

## Impact and severity
Ranged from private data disclosure to cross-tenant invoice/PII leakage [E3](https://bugbountylibrary.com/r/h1%3A2207248.md), cross-user writes [E7](https://bugbountylibrary.com/r/h1%3A2513082.md), and full internal bug detail exposure [E1](https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5.md). Writes and deletes are worse than reads: destructive mutations corrupt or remove another user's content [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md), while reads leak PII. Severity rises with object sensitivity, breadth of reachable ids, and whether the object is read versus mutated.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5.md
- E2: https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md
- E3: https://bugbountylibrary.com/r/h1%3A2207248.md
- E4: https://bugbountylibrary.com/r/blog%3Ajonbottarini-com-2018-10-09-get-as-image-function-pulls-any-insights-nrql-data-from-any-new-relic-account-idor.md
- E5: https://bugbountylibrary.com/r/bc%3A5cb33ff7-4e4b-4f2a-b943-5fdc9c4f6f38.md
- E6: https://bugbountylibrary.com/r/h1%3A3484601.md
- E7: https://bugbountylibrary.com/r/h1%3A2513082.md
- E8: https://bugbountylibrary.com/r/blog%3Afirstsight-me-2023-06-the-unexpected-0-master-id-for-account-data-manipulation.md