# Privileged endpoint missing role check

Admin or privileged routes and mutations reachable by any authenticated or low-privilege session

_Area: Web access control and IDOR. Seen in 6 disclosed reports; 2 confirmed bounties: $3,000 and $5,000; latest 2024-01-08. Updated 2026-10-24._

## How it works
An endpoint performs a privileged action but only authenticates the caller, never authorizing the specific role or scope that action requires. The broken assumption: that hiding a route in the UI, or gating the controller, means only privileged users can reach it. Any session that can reach the URL or mutation can invoke it, and the action runs with full effect. The missing check is "does this caller hold the role/scope this action demands?", and it is often applied at the wrong granularity (controller instead of per-action, public surface instead of internal).

## Where it shows up
- Admin/console routes sharing a controller with lower-privilege actions; per-action gating missing [E3](https://bugbountylibrary.com/r/h1%3A2197796.md)
- Internal or undocumented endpoints (`/admin/internal/web/graphql/*`, `/api/...`) that skip the gating of the public surface [E1](https://bugbountylibrary.com/r/blog%3Ablog-redforce-io-attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study.md)[E4](https://bugbountylibrary.com/r/h1%3A1521336.md)
- Token-minting or bootstrap endpoints (claim, start, create_admin) that issue credentials or reset passwords [E2](https://bugbountylibrary.com/r/h1%3A1103582.md)[E3](https://bugbountylibrary.com/r/h1%3A2197796.md)[E6](https://bugbountylibrary.com/r/h1%3A1245736.md)
- Credential/key listing endpoints not scoped to the caller's engines or role [E5](https://bugbountylibrary.com/r/h1%3A1218680.md)
- Secret-returning app/usersource endpoints that expose signing material [E1](https://bugbountylibrary.com/r/blog%3Ablog-redforce-io-attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study.md)

## How to review
Enumerate every route and mutation on shared controllers and check gating per action, not per controller [E3](https://bugbountylibrary.com/r/h1%3A2197796.md). For each privileged action, confirm the server verifies the caller's role/scope before acting, not just that the UI hides it [E2](https://bugbountylibrary.com/r/h1%3A1103582.md)[E4](https://bugbountylibrary.com/r/h1%3A1521336.md). The invariant: every state-changing or secret-returning endpoint must independently authorize the caller against the exact privilege the action requires. Test with the lowest-privilege session available, and re-test across every role/scope combination after any fix [E5](https://bugbountylibrary.com/r/h1%3A1218680.md).

## Variants seen
- Missing privilege check on API endpoints leaking a JWT signing secret and agent list, enabling forged admin tokens [E1](https://bugbountylibrary.com/r/blog%3Ablog-redforce-io-attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study.md)
- Integration claim token issued to any user regardless of role [E2](https://bugbountylibrary.com/r/h1%3A1103582.md)
- Bootstrap/start action reachable by editor role, resetting admin password [E3](https://bugbountylibrary.com/r/h1%3A2197796.md)
- Internal GraphQL mutations reachable by low-priv staff [E4](https://bugbountylibrary.com/r/h1%3A1521336.md)
- Credentials listing endpoint ignoring engine/role scope [E5](https://bugbountylibrary.com/r/h1%3A1218680.md)
- create_admin endpoint open to any authenticated user [E6](https://bugbountylibrary.com/r/h1%3A1245736.md)

## Why fixes fail
A fix for one role left sibling roles still able to reach the same credentials endpoint [E5](https://bugbountylibrary.com/r/h1%3A1218680.md). Controller-level auth left individual actions ungated [E3](https://bugbountylibrary.com/r/h1%3A2197796.md).

## Impact and severity
Ranged from secret/key disclosure [E1](https://bugbountylibrary.com/r/blog%3Ablog-redforce-io-attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study.md)[E5](https://bugbountylibrary.com/r/h1%3A1218680.md) to full privilege escalation to site admin [E3](https://bugbountylibrary.com/r/h1%3A2197796.md)[E6](https://bugbountylibrary.com/r/h1%3A1245736.md). In one chain, the leaked JWT secret enabled forged admin tokens, and a separate template-editing flaw turned that into RCE via Twig deserialization; the missing check was the entry point, not the whole chain [E1](https://bugbountylibrary.com/r/blog%3Ablog-redforce-io-attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study.md). Severity rises when the endpoint mints tokens or resets credentials, turning read access into complete takeover.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-redforce-io-attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study.md
- E2: https://bugbountylibrary.com/r/h1%3A1103582.md
- E3: https://bugbountylibrary.com/r/h1%3A2197796.md
- E4: https://bugbountylibrary.com/r/h1%3A1521336.md
- E5: https://bugbountylibrary.com/r/h1%3A1218680.md
- E6: https://bugbountylibrary.com/r/h1%3A1245736.md