# Role assignment without caller privilege check

Endpoints that grant roles or scopes checking membership but not the caller's right to grant that level

_Area: Web access control and IDOR. Seen in 11 disclosed reports; 5 confirmed bounties, median $2,500, range $1,000-$8,000; latest 2026-09-17. Updated 2026-10-23._

## How it works
The endpoint that writes a role, scope, or permission verifies the caller has *some* access to the object, but never verifies the caller is entitled to hand out the level being assigned. The broken assumption is "only privileged users reach this action." The UI hides the control; the backend accepts the request from any member. The missing invariant is: *caller's effective privilege >= privilege being assigned*.

## Where it shows up
- Add-user / assign-role / invite endpoints that take a role or permission value from the request [E3](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-03-facebook-bypass-ads-account-roles-html.md)[E7](https://bugbountylibrary.com/r/h1%3A836081.md).
- Scoped or limited tokens that can call the token/permission modification API [E1](https://bugbountylibrary.com/r/h1%3A1193321.md).
- Integration servlets or iframes that mint privileged credentials (JWTs, claim tokens) without a role check [E4](https://bugbountylibrary.com/r/h1%3A1103582.md).
- Admin-console routes on shared controllers where only some actions are role-gated [E6](https://bugbountylibrary.com/r/h1%3A2197796.md).
- Create-user endpoints reachable by lower-privileged admins, where the new object can later be promoted [E5](https://bugbountylibrary.com/r/h1%3A90688.md).
- GraphQL mutations that assign group membership, including auto-created default admin groups [E8](https://bugbountylibrary.com/r/h1%3A2372018.md).
- Capability filters that deny only one role (e.g. administrator) and leave every other role assignable [E2](https://bugbountylibrary.com/r/h1%3A403039.md).

## How to review
For every endpoint that writes a role, scope, or permission, identify the caller and confirm the code checks the caller's own privilege against the level being granted, not just membership in the object. The invariant: *caller's effective privilege >= privilege being assigned*. Separately, confirm a limited credential cannot modify its own scope: the token-management endpoint must require a full login session (password + 2FA), not merely a valid token [E1](https://bugbountylibrary.com/r/h1%3A1193321.md). On any 4xx, re-read state: the change may already have committed.

## Variants seen
- Analyst assigns Admin via add_user with no requester-role check [E3](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-03-facebook-bypass-ads-account-roles-html.md).
- Scoped app token widens its own scope via the authtoken API [E1](https://bugbountylibrary.com/r/h1%3A1193321.md).
- Plugin servlet mints a claim JWT for any Jira user, not just admins [E4](https://bugbountylibrary.com/r/h1%3A1103582.md).
- Limited admin creates staff user, later promoted via recovery flow [E5](https://bugbountylibrary.com/r/h1%3A90688.md).
- Editor reaches POST /start on a shared controller and resets site admin password [E6](https://bugbountylibrary.com/r/h1%3A2197796.md).
- Public /admins API accepts internal super-admin role directly [E7](https://bugbountylibrary.com/r/h1%3A836081.md).
- Program Admin adds self to default admin groups via GraphQL [E8](https://bugbountylibrary.com/r/h1%3A2372018.md).
- Blacklist capability filter lets Shop manager assign any non-admin role [E2](https://bugbountylibrary.com/r/h1%3A403039.md).

## Why fixes fail
E5 shows a created low-privilege object later promoted through an adjacent recovery flow, so fixing only the create endpoint leaves the path open. E1 shows the token endpoint must reject self-modification, not just require a valid token. E2 shows a deny-one-role blacklist leaves every other privileged role assignable.

## Impact and severity
Led to full account or tenant takeover, admin seizure, and privileged credential issuance [E1](https://bugbountylibrary.com/r/h1%3A1193321.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-03-facebook-bypass-ads-account-roles-html.md)[E4](https://bugbountylibrary.com/r/h1%3A1103582.md)[E6](https://bugbountylibrary.com/r/h1%3A2197796.md)[E7](https://bugbountylibrary.com/r/h1%3A836081.md)[E8](https://bugbountylibrary.com/r/h1%3A2372018.md). Severity is high when the granted role is admin-level or the token unlocks stored secrets; worse when escalation is self-service (a token widening its own scope).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1193321.md
- E2: https://bugbountylibrary.com/r/h1%3A403039.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-03-facebook-bypass-ads-account-roles-html.md
- E4: https://bugbountylibrary.com/r/h1%3A1103582.md
- E5: https://bugbountylibrary.com/r/h1%3A90688.md
- E6: https://bugbountylibrary.com/r/h1%3A2197796.md
- E7: https://bugbountylibrary.com/r/h1%3A836081.md
- E8: https://bugbountylibrary.com/r/h1%3A2372018.md