# Move and copy permission bypass

Move, copy, or re-attach paths that skip ownership or role checks on source or destination

_Area: Web access control and IDOR. Seen in 4 disclosed reports; 2 confirmed bounties: $600 and $1,200; latest 2025-03-13. Updated 2026-10-23._

## How it works
A permission check is written for the primary action (create, delete, upload) but the same end state is reachable through a secondary operation: move, copy, transfer, re-attach, or import. That secondary path either re-implements the check incompletely or omits it, so the actor reaches data or effects the primary path would have blocked. The broken assumption is that "the permission on the action" equals "the permission on the outcome."

## Where it shows up
- Endpoints that set an owner/org/tenant field (e.g. `idOrganization`, `tenant_id`, `installation_id`) on an existing object.
- Move/copy/import endpoints that carry child resources (attachments, designs, files) into a new parent.
- Re-onboarding or re-connecting a previously deleted integration by identifier.
- Alternate access paths (WebDAV, sync clients, API) that resolve share mountpoints differently from the web UI.
- Destructive-effect operations (move-out, archive) gated by a different check than delete.

## How to review
For every operation that changes an object's parent, owner, or tenant, verify the check covers both sides: the actor's rights on the source and the required rights on the destination, including any child resources carried along. The invariant: any operation producing the same end state as a gated action must enforce that action's permission. For integrations, confirm the identifier being attached is proven to belong to the requesting user, not merely known. For shares, confirm copy/move resolves to the shared object, not the owner's root.

## Variants seen
- Re-attaching a deleted integration by known tenant/installation id, re-binding prior data [E1](https://bugbountylibrary.com/r/h1%3A2086301.md).
- Moving a board out of a workspace to bypass admin-only deletion restriction [E2](https://bugbountylibrary.com/r/bc%3A598061cf-5339-4684-9fb0-412db75521d1.md).
- Moving an issue to copy designs into a project without destination role check [E3](https://bugbountylibrary.com/r/h1%3A1112297.md).
- WebDAV copy of a shared file resolving to the sharer's whole home directory [E4](https://bugbountylibrary.com/r/h1%3A258084.md).

## Impact and severity
Cross-tenant data exposure and privilege escalation; median bounty 900. Worse when identifiers are enumerable [E1](https://bugbountylibrary.com/r/h1%3A2086301.md) or when the bypass yields bulk data access rather than a single object [E4](https://bugbountylibrary.com/r/h1%3A258084.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A2086301.md
- E2: https://bugbountylibrary.com/r/bc%3A598061cf-5339-4684-9fb0-412db75521d1.md
- E3: https://bugbountylibrary.com/r/h1%3A1112297.md
- E4: https://bugbountylibrary.com/r/h1%3A258084.md