# Share link policy bypass

Share/preview endpoints that mint or accept tokens without enforcing password, type, or revocation policy

_Area: Web access control and IDOR. Seen in 4 disclosed reports; 3 confirmed bounties, median $250, range $50-$3,000; latest 2022-06-01. Updated 2026-10-23._

## How it works
A share or preview feature assumes that any request carrying a valid share token has already passed the share's policy checks (password, share type, revocation). That assumption breaks when a second code path — a token-minting endpoint, a preview/thumbnail handler, or an alternate creation flow — accepts or produces the token without re-running those checks. The policy is enforced on the main path but not on every path that touches the same token.

## Where it shows up
- Endpoints that generate share/preview URLs without authentication (e.g. a preview bar that returns a preview link) [E1](https://bugbountylibrary.com/r/h1%3A421859.md)
- Auxiliary handlers keyed only by share token: preview, thumbnail, download, OG-image, avatar [E3](https://bugbountylibrary.com/r/h1%3A231917.md)
- Alternate share-creation paths (federation, import, re-share) that write a different share_type than the policy targets [E2](https://bugbountylibrary.com/r/h1%3A838510.md)
- Policy checks written per share_type or per endpoint rather than at a single choke point
- Preview mode that renders content without consulting the storefront/share password gate [E1](https://bugbountylibrary.com/r/h1%3A421859.md)

## How to review
Identify every endpoint that accepts or mints a share token. For each, confirm the invariant: before returning content or a usable link, the handler verifies the share exists, is not revoked, matches the expected type, and that any required password was supplied. Check that token generation itself requires authorization. For policy enforcement, verify the check keys on the actual stored share_type and runs on all creation paths, not just the primary one. Compare stored type against the type the policy expects [E2](https://bugbountylibrary.com/r/h1%3A838510.md).

## Variants seen
- Unauthenticated minting endpoint leaks a preview URL that bypasses storefront password protection [E1](https://bugbountylibrary.com/r/h1%3A421859.md)
- Federated add flow stores share_type 3 instead of 6, skipping the link-share password policy [E2](https://bugbountylibrary.com/r/h1%3A838510.md)
- Public preview handler renders password-protected image shares without checking the password [E3](https://bugbountylibrary.com/r/h1%3A231917.md)

## Impact and severity
Exposure of password-protected content to unauthenticated parties holding only a share ID or leaked link [E1](https://bugbountylibrary.com/r/h1%3A421859.md)[E3](https://bugbountylibrary.com/r/h1%3A231917.md), and silent violation of admin-enforced password policy [E2](https://bugbountylibrary.com/r/h1%3A838510.md). Severity rises when the bypass needs no credentials and the token is guessable or leakable, and when the content is sensitive (full images, protected store content).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A421859.md
- E2: https://bugbountylibrary.com/r/h1%3A838510.md
- E3: https://bugbountylibrary.com/r/h1%3A231917.md