# Missing permission gate on API route

Route reaches a privileged sink without its own scope/role/readonly guard; diff sibling routes

_Area: Web access control and IDOR. Seen in 3 disclosed reports; one confirmed bounty: $480; latest 2026-07-24. Updated 2026-11-01._

## How it works
A privileged operation is protected by a permission check that is applied at the wrong granularity or not at all. The assumption that breaks is "this route group's guard covers every route in it." When the group guard is the broad one (Read) and the dangerous route needs the narrow one (Write), or when a sibling endpoint carries an extra middleware that this one omits, the handler runs for callers who should be refused. The check exists somewhere in the codebase, so reviewers assume it applies here too.

## Where it shows up
- Route groups with a single scope/role middleware, where some routes add a local narrower guard and others do not.
- Hierarchical scopes (Write implies Read): a group-level Read guard silently authorizes every route.
- Alternate code paths that reach the same dangerous sink (raw SQL, credential persistence, device access) as a properly guarded endpoint.
- Handlers that branch on a parameter (e.g. `method=2`) into a privileged code path after only the generic auth check.
- Browser/OS APIs in renderer or client context (Bluetooth, USB, Serial, HID) with no custom permission handler configured.

## How to review
Enumerate every route in a guarded group and diff the middleware chain of each against its siblings. The invariant: **every route that reaches a privileged sink must itself carry the narrowest required guard, independent of the group guard.** For each handler, trace from entry to sink (db.Query, credential write, device object return) and confirm a check for the specific privilege sits on that path. For hierarchical scopes, confirm write routes add the explicit Write guard rather than relying on Read. For client APIs, confirm a permission handler is registered and that absence of one yields an error, not access.

## How finders spotted it
- Compared sibling policy mutation routes (create, update, CORS, callback, delete), each adding a local Admin.Write guard, against the signin route that lacked it; a focused scope test confirmed Read alone fails CheckScope(Write) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq88-5x99-x3gf.md).
- Code review of router middleware: noticed `/api/query/sql` chains CheckAdminRole and CheckReadonly while `/api/search/fullTextSearchBlock` only has CheckAuth, then traced `method=2` to raw db.Query [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j7wh-x834-p3r7.md).
- Called a permission-gated browser API from a renderer expecting an error and got a device object instead [E3](https://bugbountylibrary.com/r/h1%3A1519099.md).

## Variants seen
- Missing narrow scope guard on one route inside a broadly guarded admin group [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq88-5x99-x3gf.md).
- Missing role/readonly middleware on an alternate endpoint reaching the same SQL sink [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j7wh-x834-p3r7.md).
- Missing permission enforcement in the platform for a browser API with no custom handler [E3](https://bugbountylibrary.com/r/h1%3A1519099.md).

## Impact and severity
E1 let a read-only OAuth token overwrite storage policy credentials [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq88-5x99-x3gf.md); E2 let any Reader execute arbitrary SQL [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j7wh-x834-p3r7.md); E3 gave renderers read/write access to a random nearby Bluetooth device [E3](https://bugbountylibrary.com/r/h1%3A1519099.md). Impact rises with what the sink controls: raw SQL and credential persistence reach far beyond the caller's role, and device access crosses a physical trust boundary. Severity is set by the gap between the caller's intended privilege and the sink's power, not by the endpoint's apparent purpose.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-hq88-5x99-x3gf.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-j7wh-x834-p3r7.md
- E3: https://bugbountylibrary.com/r/h1%3A1519099.md