# Missing or weakened permission gate

Handler acts on a resource without the exact permission check, or with a weaker one

_Area: Web access control and IDOR. Seen in 6 disclosed reports; 2 confirmed bounties: $500 and $12,000; latest 2026-10-15. Updated 2026-10-23._

## How it works
A handler performs an action on a resource but never runs the authorization check the feature depends on, or runs a weaker check than the action requires. The assumption that breaks: that a check performed earlier (in a controller, a validator, a parent object) still applies downstream. When that earlier check early-returns, is skipped for some object shape, or is simply the wrong permission, the action proceeds unchecked. Related shapes: a dispatcher that fails open when a method carries no permission attribute, a handler that forwards a caller-supplied privilege field (role) into a privileged operation [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-54mm-6729-r5wp.md), and an async check whose result is never awaited, so a truthy Promise stands in for a real result [E2](https://bugbountylibrary.com/r/h1%3A1724016.md).

## Where it shows up
- Validation methods with early returns, e.g. `return unless project.group`, where the same params still flow into services that assume validation ran [E1](https://bugbountylibrary.com/r/h1%3A689314.md)
- Finders that return objects by visibility (public) rather than by feature-level access [E1](https://bugbountylibrary.com/r/h1%3A689314.md)
- Attribute-driven dispatchers that silently allow methods lacking a permission attribute [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-54mm-6729-r5wp.md)
- Handlers forwarding caller-supplied `role` into user creation [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-54mm-6729-r5wp.md)
- Async security checks (`validatePassword`, `bcrypt.compare`) whose result is not awaited [E2](https://bugbountylibrary.com/r/h1%3A1724016.md)
- Endpoints authorizing with `update` where `manageUsers` is required [E2](https://bugbountylibrary.com/r/h1%3A1724016.md)
- Share-update endpoints letting a resharer flip a permission attribute they do not hold [E2](https://bugbountylibrary.com/r/h1%3A1724016.md)
- Alternate write primitives (rename, move, copy) reaching a path the user is denied [E5](https://bugbountylibrary.com/r/h1%3A642515.md)
- Endpoints rendering CI job artifacts without verifying CI/pipeline access [E6](https://bugbountylibrary.com/r/h1%3A676976.md)
- Adjacent: Electron renderer browser APIs (Bluetooth, USB, Serial) reachable when no custom permission handler is configured [E4](https://bugbountylibrary.com/r/h1%3A1519099.md)

## How to review
For every handler, identify the resource and the exact permission the action needs, then confirm that check runs on this request path with the real actor and target. Trace params from any early-returning validator into downstream services and jobs; do not assume validation ran. Confirm async checks are awaited and their resolved value tested. For permission attributes, verify the actor holds the attribute before allowing them to set it. For attribute-driven dispatchers, enumerate every exposed method and confirm each has a gate; treat absence as deny. For artifact endpoints, confirm the same permission the feature requires is enforced here. The invariant: no state change or data read occurs unless the acting principal holds the specific permission for that exact resource.

## Variants seen
- Early-return validator skips authorization for user-namespace projects; export job is a second independent missing check [E1](https://bugbountylibrary.com/r/h1%3A689314.md)
- Weaker permission used where a stronger one is required; unawaited async check [E2](https://bugbountylibrary.com/r/h1%3A1724016.md)
- Resharer sets a download attribute they were never granted [E2](https://bugbountylibrary.com/r/h1%3A1724016.md)
- Default-allow dispatcher plus forwarded role field [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-54mm-6729-r5wp.md)
- Rename path not re-validated against server-side folder permissions [E5](https://bugbountylibrary.com/r/h1%3A642515.md)
- Report endpoint re-implements access control and misses CI permission [E6](https://bugbountylibrary.com/r/h1%3A676976.md)
- Browser-API permission gate absent when no custom handler configured (Electron-specific) [E4](https://bugbountylibrary.com/r/h1%3A1519099.md)

## Impact and severity
Ranged from confidential data export (private repos, issues, snippets) [E1](https://bugbountylibrary.com/r/h1%3A689314.md) and PII leaks [E2](https://bugbountylibrary.com/r/h1%3A1724016.md) to admin self-escalation [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-54mm-6729-r5wp.md), destructive overwrites of protected folders [E5](https://bugbountylibrary.com/r/h1%3A642515.md), and device access [E4](https://bugbountylibrary.com/r/h1%3A1519099.md). Severity rises when the bypass is silent, chains with other flaws [E1](https://bugbountylibrary.com/r/h1%3A689314.md), or destroys data [E5](https://bugbountylibrary.com/r/h1%3A642515.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A689314.md
- E2: https://bugbountylibrary.com/r/h1%3A1724016.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-54mm-6729-r5wp.md
- E4: https://bugbountylibrary.com/r/h1%3A1519099.md
- E5: https://bugbountylibrary.com/r/h1%3A642515.md
- E6: https://bugbountylibrary.com/r/h1%3A676976.md