# Search and query filters skip ownership

Search, expansion, or relation filters returning objects outside the caller's ownership, group, or tenant scope

_Area: Web access control and IDOR. Seen in 5 disclosed reports; latest 2026-05-14. Updated 2026-10-24._

## How it works
A query layer resolves or joins objects the caller does not own, and authorization is applied to the primary document or top-level request but not to the related objects reached through expansion, relation filters, or index scoping. The assumption that breaks: that filtering by a scope (a group, a project, a field) also constrains everything the query traverses into. It does not, so private objects surface through a path the access check never covered.

## Where it shows up
- Generic expand/decoration mechanisms keyed by identifiers, where user-controlled strings may be treated as references and resolved server-side [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)
- ORM filter operators that auto-join relations (createdBy, updatedBy, publishedBy) into tables the caller cannot read [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjg2-95x7-8qmx.md)
- Search backends (Elasticsearch) where scope filters apply to the primary doc but not joined/related docs like notes [E3](https://bugbountylibrary.com/r/h1%3A710006.md)
- Group/project-scoped search returning documents from other private groups [E4](https://bugbountylibrary.com/r/h1%3A708820.md)
- List endpoints whose response counts act as an oracle over joined private columns [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjg2-95x7-8qmx.md)

## How to review
Trace every query path from caller input to result set. The invariant: every object returned, including those reached by expansion, relation traversal, or index scoping, must be checked against the caller's authorization on that object's own owner/group/tenant, not just the entry point. Check:
- Is there a per-field allowlist for what may be expanded/resolved? [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)
- Do filter operators block traversal into relation targets the caller lacks read permission on? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjg2-95x7-8qmx.md)
- Does the search backend filter related documents by the searcher's authorization on the parent? [E3](https://bugbountylibrary.com/r/h1%3A710006.md)
- Are group-scoped queries constrained to the requested group's documents? [E4](https://bugbountylibrary.com/r/h1%3A708820.md)
- Do response counts or error differences leak joined private data? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjg2-95x7-8qmx.md)

## Variants seen
- URN/decoration expansion resolving arbitrary references from text fields [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)
- Relational filter operator chains joining into admin tables [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjg2-95x7-8qmx.md)
- Notes-scope search returning private noteable metadata [E3](https://bugbountylibrary.com/r/h1%3A710006.md)
- Group search leaking cross-group documents [E4](https://bugbountylibrary.com/r/h1%3A708820.md)

## Impact and severity
Ranged from leaking existence and membership metadata [E3](https://bugbountylibrary.com/r/h1%3A710006.md)[E4](https://bugbountylibrary.com/r/h1%3A708820.md) to full database enumeration of emails [E1](https://bugbountylibrary.com/r/h1%3A1806939.md) and admin account takeover via token extraction [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjg2-95x7-8qmx.md). Severity rose where results were enumerable (sequential IDs [E1](https://bugbountylibrary.com/r/h1%3A1806939.md)) or where a boolean oracle turned counts into extraction of secrets [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjg2-95x7-8qmx.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1806939.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-rjg2-95x7-8qmx.md
- E3: https://bugbountylibrary.com/r/h1%3A710006.md
- E4: https://bugbountylibrary.com/r/h1%3A708820.md