# Unscoped tokens grant cross-tenant access

Token validated for validity but not bound to tenant, user, role, or endpoint it is used against

_Area: Web access control and IDOR. Seen in 9 disclosed reports; 4 confirmed bounties, median $950, range $150-$22,530; latest 2026-07-22. Updated 2026-10-23._

## How it works
A token, signature, or credential is minted for one narrow purpose but validated only as "is this valid?" rather than "is this valid for this object, tenant, role, and action?" The server confirms authenticity (the token is genuine) but skips authorization (this token may act here). The broken assumption is that a token's origin implies its permitted use, so anyone holding it can replay it against other endpoints, other users' objects, or other tenants.

## Where it shows up
- Opaque per-request tokens minted for attacker-controlled cleartext (usernames, profile fields) and accepted by unrelated endpoints [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20201028215444-http-incidentsecurity-com-how-spending-our-saturday-hacking-earned-us-20k.md)
- Application-wide signatures embedded in page source that authorize admin APIs regardless of the user's role [E2](https://bugbountylibrary.com/r/h1%3A156520.md)
- New feature endpoints that skip the centralized OAuth scope middleware the legacy API enforces [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-twitter-privesc.md)[E4](https://bugbountylibrary.com/r/h1%3A1032468.md)
- Preview/bypass tokens (`_bt`) accepted globally instead of per store [E5](https://bugbountylibrary.com/r/h1%3A961929.md)
- File access tokens leaked in client-visible URLs (websocket) that also authorize sibling endpoints [E7](https://bugbountylibrary.com/r/h1%3A1724021.md)
- Machine/bot identities spawned from a restricted user that default to a broader visibility tier [E8](https://bugbountylibrary.com/r/h1%3A1193062.md)

## How to review
For every token, ask: what is it bound to? The invariant is that validation must check the specific resource, tenant, role, and action, not merely authenticity. Confirm minting records intended scope server-side and every consuming endpoint enforces it. Concrete checks: mint a token in tenant A and replay in tenant B; mint under a read-only role and attempt a write; mint for one object and request a sibling object; mint for one endpoint and call another. Also verify tokens are revoked on member removal and key rotation [E2](https://bugbountylibrary.com/r/h1%3A156520.md), and that UI restrictions (password pages, watermarks, download blocks) are enforced at the API, not just the client [E7](https://bugbountylibrary.com/r/h1%3A1724021.md).

## Variants seen
- Username-change token replayed to read other users' invoices [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20201028215444-http-incidentsecurity-com-how-spending-our-saturday-hacking-earned-us-20k.md)
- App-wide signature used against admin endpoints after removal [E2](https://bugbountylibrary.com/r/h1%3A156520.md)
- Read-only app token creating/deleting fleets because new endpoints skipped scope checks [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-twitter-privesc.md)[E4](https://bugbountylibrary.com/r/h1%3A1032468.md)
- Storefront `_bt` token unlocking another store's preview [E5](https://bugbountylibrary.com/r/h1%3A961929.md)
- Installation read permission accepted in place of explicit repo grant [E6](https://bugbountylibrary.com/r/h1%3A3641229.md)
- WOPI token from websocket used on `/contents` to bypass secure view [E7](https://bugbountylibrary.com/r/h1%3A1724021.md)
- Project token bot user inheriting internal visibility from an external user [E8](https://bugbountylibrary.com/r/h1%3A1193062.md)

## Why fixes fail
E2 shows the signature survived member removal and key rotation, so revocation was incomplete. E7 shows the restriction lived in the UI while the token still authorized the raw endpoint. E3/E4 show new endpoints bypassing the shared scope middleware, so fixes must cover every new route, not just legacy ones.

## Impact and severity
Cross-user and cross-tenant data exposure, admin takeover, privilege escalation, and bypass of paid or protected content. Severity rises with token breadth (tenant-agnostic, app-wide) and when it grants admin, write, or download rights. Median bounty 950, up to 22530.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20201028215444-http-incidentsecurity-com-how-spending-our-saturday-hacking-earned-us-20k.md
- E2: https://bugbountylibrary.com/r/h1%3A156520.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-twitter-privesc.md
- E4: https://bugbountylibrary.com/r/h1%3A1032468.md
- E5: https://bugbountylibrary.com/r/h1%3A961929.md
- E6: https://bugbountylibrary.com/r/h1%3A3641229.md
- E7: https://bugbountylibrary.com/r/h1%3A1724021.md
- E8: https://bugbountylibrary.com/r/h1%3A1193062.md