# Inconsistent authorization across endpoints

Same resource, different paths enforce access differently; check every endpoint, surface and code path separately

_Area: Web access control and IDOR. Seen in 14 disclosed reports; 9 confirmed bounties, median $1,000, range $250-$30,000; latest 2026-10-12. Updated 2026-10-23._

## How it works
A resource is protected by a check that lives in one place, but the same resource is reachable through other endpoints, code paths, or API surfaces that reimplement the check differently or skip it. The broken assumption is that "the resource is protected" — in reality only one path is protected. The invariant that must hold: authorization is enforced at the data-access layer, or identically on every path, not in a single filter, UI control, or create-time check. The discriminator versus plain missing-authz or IDOR: does a check exist on *any* path? If yes, but not on all of them, it is this class. If no path checks at all, it is plain IDOR.

## Where it shows up
- Access enforced only via a query filter (`pre_get_posts`) while the core REST single-item endpoint uses `get_post()` by ID [E3](https://bugbountylibrary.com/r/h1%3A3801107.md)
- A permission toggle checked on create but not on edit/update, across REST/GraphQL/UI [E1](https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2021-03-10-fork-collab-abuse-html.md)
- A mobile user-agent branch of an endpoint that falls back to a superuser account, ignoring block/privacy rules [E2](https://bugbountylibrary.com/r/blog%3A003random-com-posts-meta-bountycon-instagram-writeup.md)
- A third-party integration's join action that skips the product's own Invite-Only membership setting [E5](https://bugbountylibrary.com/r/bc%3Afd6d6d3b-916c-4ad8-b355-3fa59a5f20be.md)
- A UI-only restriction (owner-only setting) not mirrored in the backing REST endpoint [E5](https://bugbountylibrary.com/r/bc%3Afd6d6d3b-916c-4ad8-b355-3fa59a5f20be.md)
- A secondary app's search endpoint enforcing only the master enumeration toggle, skipping group/full-match restrictions [E6](https://bugbountylibrary.com/r/h1%3A3617729.md)
- A renderer/attachment endpoint serving file bytes without the share's download restriction [E8](https://bugbountylibrary.com/r/h1%3A1965156.md)
- A member-writable ownership field (owner/lead id) later trusted as the authorization field, with PATCH gated more loosely than DELETE [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c78w-2q4r-68r7.md)
- Internal/admin GraphQL endpoints that skip the privilege check applied on the public surface [E7](https://bugbountylibrary.com/r/h1%3A1521336.md)

## How to review
Enumerate every surface that reads or writes the resource: REST single-item, feeds, oEmbed, XML-RPC, GraphQL, UI actions, integration endpoints, secondary-app endpoints, internal/admin routes. For each, trace the check down to the actual data-access call (the `get_post`/query/attach), not just the permission string at the top. Ask whether a different entry point, header, parameter, or API surface can skip that call. Build a table of surface vs permission string vs data-access call and diff the rows; any row that differs is a candidate. The canonical case is create-vs-edit divergence: a toggle validated at creation but not on update [E1](https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2021-03-10-fork-collab-abuse-html.md).

## Variants seen
- Query-filter-only enforcement bypassed by direct ID lookup [E3](https://bugbountylibrary.com/r/h1%3A3801107.md)
- Create-vs-edit and REST-vs-GraphQL divergence [E1](https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2021-03-10-fork-collab-abuse-html.md)
- Header-dependent alternate path with superuser fallback [E2](https://bugbountylibrary.com/r/blog%3A003random-com-posts-meta-bountycon-instagram-writeup.md)
- Integration endpoint ignoring workspace join restriction [E5](https://bugbountylibrary.com/r/bc%3Afd6d6d3b-916c-4ad8-b355-3fa59a5f20be.md)
- UI-only restriction not enforced by backing API [E5](https://bugbountylibrary.com/r/bc%3Afd6d6d3b-916c-4ad8-b355-3fa59a5f20be.md)
- Secondary app enforcing a subset of platform restrictions [E6](https://bugbountylibrary.com/r/h1%3A3617729.md)
- Renderer/attachment path skipping share restriction [E8](https://bugbountylibrary.com/r/h1%3A1965156.md)
- Mutable ownership field trusted by a stricter sibling route [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c78w-2q4r-68r7.md)
- Internal/admin surface skipping public-surface gating [E7](https://bugbountylibrary.com/r/h1%3A1521336.md)

## Impact and severity
Led to reading private posts, private forum content, and member data, and to privilege escalation (self-join, write access, owner-only settings). Severity rises when the bypass is unauthenticated [E3](https://bugbountylibrary.com/r/h1%3A3801107.md) or crosses tenants/roles [E1](https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2021-03-10-fork-collab-abuse-html.md)[E5](https://bugbountylibrary.com/r/bc%3Afd6d6d3b-916c-4ad8-b355-3fa59a5f20be.md)[E7](https://bugbountylibrary.com/r/h1%3A1521336.md). E8 is a boundary case: the attachment path checks file access but never the download restriction, so it sits between this class and plain missing-authz.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2021-03-10-fork-collab-abuse-html.md
- E2: https://bugbountylibrary.com/r/blog%3A003random-com-posts-meta-bountycon-instagram-writeup.md
- E3: https://bugbountylibrary.com/r/h1%3A3801107.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-c78w-2q4r-68r7.md
- E5: https://bugbountylibrary.com/r/bc%3Afd6d6d3b-916c-4ad8-b355-3fa59a5f20be.md
- E6: https://bugbountylibrary.com/r/h1%3A3617729.md
- E7: https://bugbountylibrary.com/r/h1%3A1521336.md
- E8: https://bugbountylibrary.com/r/h1%3A1965156.md