# Unchecked object resolution (IDOR)

IDs, foreign keys or URNs resolved server-side without binding the object to the caller's rights

_Area: Web access control and IDOR. Seen in 5 disclosed reports; one confirmed bounty: $11,250; latest 2024-02-19. Updated 2026-10-23._

## How it works
An endpoint takes an identifier (entity id, foreign key, URN, or reference) and resolves it to data or an action, but never checks that the caller is entitled to that specific object. The code assumes that supplying an id implies authorization, or it authorizes against one object while acting on another. The broken assumption: the caller's identity and the object's identity are checked separately and never joined.

## Where it shows up
- Mutations/updates taking a foreign key (boardId, parentId, videoID) in the body that the server trusts without re-authorizing against the new parent [E5](https://bugbountylibrary.com/r/h1%3A1450117.md)[E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md)
- Generic expand/decoration or reference-resolution mechanisms keyed by URNs, where user-controlled strings get resolved server-side [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)
- Status/read endpoints keyed only on an object id created earlier in a workflow, returning full details before the acceptance gate is passed [E4](https://bugbountylibrary.com/r/h1%3A1785079.md)
- Import/restore features writing files into a shared uploads path keyed only by secret+filename, without checking existing ownership [E3](https://bugbountylibrary.com/r/h1%3A534794.md)
- Search backends applying authz to the primary document but not joined/related objects (notes -> noteable -> project) [E6](https://bugbountylibrary.com/r/h1%3A710006.md)

## How to review
For every endpoint taking an id or reference, trace where it is resolved and confirm an authorization check binds that object to the caller's role/tenant/ownership before any read or write. The invariant: authorization is evaluated against the object actually acted upon, not a sibling or the caller-supplied parent. Check that foreign-key fields in request bodies are re-authorized against the target parent [E5](https://bugbountylibrary.com/r/h1%3A1450117.md), that expandable fields are allowlisted per field [E1](https://bugbountylibrary.com/r/h1%3A1806939.md), that workflow gates (acceptance) are enforced at read time, not just creation [E4](https://bugbountylibrary.com/r/h1%3A1785079.md), and that import paths reject overwriting objects owned by another project/user [E3](https://bugbountylibrary.com/r/h1%3A534794.md). For search, verify filters traverse to the parent's ACL [E6](https://bugbountylibrary.com/r/h1%3A710006.md).

## Variants seen
- URN/decoration expansion resolving arbitrary references in text fields [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)
- Destructive media mutation on foreign object ids with fuzzed geometry params [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md)
- Import overwriting another user's upload via shared storage key [E3](https://bugbountylibrary.com/r/h1%3A534794.md)
- Workflow status endpoint leaking PII before counterparty acceptance [E4](https://bugbountylibrary.com/r/h1%3A1785079.md)
- Parent-reassignment IDOR via client-supplied boardId [E5](https://bugbountylibrary.com/r/h1%3A1450117.md)
- Search scope leaking related private objects [E6](https://bugbountylibrary.com/r/h1%3A710006.md)

## Impact and severity
Ranged from bulk PII exposure (email database [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)) to corruption of others' media [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md), cross-tenant file overwrite enabling backdoored binaries [E3](https://bugbountylibrary.com/r/h1%3A534794.md), and cross-tenant data leakage [E5](https://bugbountylibrary.com/r/h1%3A1450117.md)[E6](https://bugbountylibrary.com/r/h1%3A710006.md). Severity rises with scale of enumeration (sequential ids [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)), destructive or corrupting actions [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md)[E3](https://bugbountylibrary.com/r/h1%3A534794.md), and PII sensitivity [E4](https://bugbountylibrary.com/r/h1%3A1785079.md). Async processing can mask impact until later [E2](https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1806939.md
- E2: https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965.md
- E3: https://bugbountylibrary.com/r/h1%3A534794.md
- E4: https://bugbountylibrary.com/r/h1%3A1785079.md
- E5: https://bugbountylibrary.com/r/h1%3A1450117.md
- E6: https://bugbountylibrary.com/r/h1%3A710006.md