# Privileged mutation missing permission gate

Mutations that change privileges or config without checking the caller's permission for that specific field

_Area: Web access control and IDOR. Seen in 4 disclosed reports; latest 2026-09-17. Updated 2026-10-30._

## How it works
A mutation or action changes something sensitive — a privilege flag, an ACL entry, an ownership field, a config value — but the code only checks a broad or adjacent permission, or none at all. The assumption that breaks: that reaching the endpoint implies authority to change the field. In practice the endpoint is reachable by a lower-privileged caller, and the sensitive field is written anyway. The gate exists somewhere (the UI, a sibling endpoint, a stricter helper) but not on this write path.

## Where it shows up
- Mutations accepting an object ID plus privileged fields (access flags, PINs, ownership, role) [E3](https://bugbountylibrary.com/r/h1%3A1018094.md)
- Permission helpers reused as gates: a low-privilege helper (e.g. moderate) guarding an edit/ownership-transfer path while destructive paths use a stricter helper [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8x77-f38v-4m5j.md)
- Blueprint/schema fields lacking the `security@` guard their sibling fields carry [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xhfv-7758-r9hx.md)
- AJAX/JSON action handlers behind a page that itself returns permission denied [E4](https://bugbountylibrary.com/r/h1%3A142101.md)
- Asymmetry between create/edit and delete checks on the same resource [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8x77-f38v-4m5j.md)

## How to review
For each mutation, list the fields it can write and the permission each field requires. The invariant: every privileged field write must be gated by a check for that field's permission, evaluated against the caller — not merely the endpoint's coarse permission. Compare sibling blueprints/endpoints field-by-field for identical guards [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xhfv-7758-r9hx.md). Grep every call site of a permission helper and compare against the stricter checks on destructive paths [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8x77-f38v-4m5j.md). Test the underlying handler directly when the UI denies access [E4](https://bugbountylibrary.com/r/h1%3A142101.md).

## Variants seen
- Missing schema-level guard on a group ACL field, letting an operator write `admin.super:true` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xhfv-7758-r9hx.md)
- Weak helper reused as edit/ownership-transfer gate, laundering into deletion [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8x77-f38v-4m5j.md)
- GraphQL mutation writing POS access/PIN on caller's own record without field-level authz [E3](https://bugbountylibrary.com/r/h1%3A1018094.md)
- Zero-permission staff mutating favorites via unguarded AJAX endpoints [E4](https://bugbountylibrary.com/r/h1%3A142101.md)

## Impact and severity
Escalation to super-admin [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xhfv-7758-r9hx.md), self-granted POS access [E3](https://bugbountylibrary.com/r/h1%3A1018094.md), arbitrary video deletion via ownership transfer [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8x77-f38v-4m5j.md), and unauthorized data mutation by a no-permission account [E4](https://bugbountylibrary.com/r/h1%3A142101.md). Severity rises when the mutation touches privilege flags or ownership, since one write can unlock further actions.

## Why fixes fail
E1 shows a fix applied to one blueprint (account.yaml) but not its functional twin (group.yaml), leaving the same weakness open.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-xhfv-7758-r9hx.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-8x77-f38v-4m5j.md
- E3: https://bugbountylibrary.com/r/h1%3A1018094.md
- E4: https://bugbountylibrary.com/r/h1%3A142101.md