# GraphQL mutation missing authorization check

Mutations acting on objects or roles without verifying caller ownership, tenant, or permission

_Area: Web access control and IDOR. Seen in 5 disclosed reports; 3 confirmed bounties, median $1,500, range $1,000-$2,000; latest 2020-10-22. Updated 2026-10-23._

## How it works
A mutation performs its action using whatever identity the caller presents, but never binds that identity to the specific object or capability involved. The broken assumption: that a valid session, token, or staff account implies authorization for the target. Instead the mutation trusts a client-supplied identifier — a session tied to the attacker's own tenant, an object ID, an exchange ID, a source path — and acts on it without confirming the caller owns or may access that object, or holds the required role [E1](https://bugbountylibrary.com/r/h1%3A884159.md)[E3](https://bugbountylibrary.com/r/h1%3A980511.md)[E4](https://bugbountylibrary.com/r/h1%3A917875.md)[E5](https://bugbountylibrary.com/r/h1%3A898528.md).

## Where it shows up
- Mutations taking both a session token and an integrity value (hmac) where the hmac is optional or not enforced [E1](https://bugbountylibrary.com/r/h1%3A884159.md)
- Undocumented or internal mutations under paths like /admin/internal/ that skip checks applied to public APIs [E2](https://bugbountylibrary.com/r/h1%3A981472.md)[E3](https://bugbountylibrary.com/r/h1%3A980511.md)
- Token- or session-minting mutations reachable from low-privilege roles [E5](https://bugbountylibrary.com/r/h1%3A898528.md)
- Mobile app flows that yield usable tokens for restricted accounts [E4](https://bugbountylibrary.com/r/h1%3A917875.md)
- Copy/clone/import mutations that take a source reference from another tenant [E2](https://bugbountylibrary.com/r/h1%3A981472.md)

## How to review
For each mutation, identify the object it acts on and the caller's identity, then confirm a server-side check binds them. Two distinct properties must hold: (1) object/tenant binding — the caller owns or is permitted on the target object, not merely on some object they supplied; (2) role/permission enforcement — the required permission is checked regardless of how the request was formed [E3](https://bugbountylibrary.com/r/h1%3A980511.md)[E5](https://bugbountylibrary.com/r/h1%3A898528.md). Treat hmac as an integrity check, not an authorization control; confirm it is mandatory, not optional [E1](https://bugbountylibrary.com/r/h1%3A884159.md). For copy/import mutations, verify the source reference is validated against the caller's permissions on the destination [E2](https://bugbountylibrary.com/r/h1%3A981472.md). Replay each mutation from a zero-permission account and from a different tenant; success is the failure.

## Variants seen
- Cross-tenant action via client-supplied session and dropped hmac [E1](https://bugbountylibrary.com/r/h1%3A884159.md)
- Missing permission check on internal mutation [E3](https://bugbountylibrary.com/r/h1%3A980511.md)
- Missing check on receipt/SMS mutation using leaked mobile token [E4](https://bugbountylibrary.com/r/h1%3A917875.md)
- Missing Apps permission on session-token minting [E5](https://bugbountylibrary.com/r/h1%3A898528.md)
- Copy mutation accepting another tenant's source without destination permission [E2](https://bugbountylibrary.com/r/h1%3A981472.md)

## Impact and severity
Unauthorized state changes and cross-tenant reach: purchasing labels on another store's orders [E1](https://bugbountylibrary.com/r/h1%3A884159.md), copying files into a store without upload rights [E2](https://bugbountylibrary.com/r/h1%3A981472.md), altering store customer email [E3](https://bugbountylibrary.com/r/h1%3A980511.md), leaking order details via SMS [E4](https://bugbountylibrary.com/r/h1%3A917875.md), minting app session tokens [E5](https://bugbountylibrary.com/r/h1%3A898528.md). Severity rises with cross-tenant reach and credential minting; zero-permission or low-privilege accounts make it worse.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A884159.md
- E2: https://bugbountylibrary.com/r/h1%3A981472.md
- E3: https://bugbountylibrary.com/r/h1%3A980511.md
- E4: https://bugbountylibrary.com/r/h1%3A917875.md
- E5: https://bugbountylibrary.com/r/h1%3A898528.md