# Unauthenticated GraphQL data exposure

GraphQL queries or mutations reachable before auth middleware runs, returning private data or privileged actions

_Area: Web access control and IDOR. Seen in 3 disclosed reports; one confirmed bounty: $5,000; latest 2023-03-10. Updated 2026-11-01._

## How it works
GraphQL endpoints are often mounted as a single route that resolves many operations. The assumption that breaks is that authentication/authorization is enforced *before* the resolver runs. When the endpoint is reachable before the auth gate (or the resolver itself never checks the caller), any query or mutation in the schema executes with full backend privilege. The gate may exist elsewhere — a client-side redirect, a UI that hides the button, a role check in the admin app — but the GraphQL route does not consult it [E1](https://bugbountylibrary.com/r/h1%3A397130.md)[E2](https://bugbountylibrary.com/r/h1%3A1868473.md)[E3](https://bugbountylibrary.com/r/h1%3A905543.md).

## Where it shows up
- A login redirect that happens client-side: the pre-redirect HTML and JS bundle are served unauthenticated [E1](https://bugbountylibrary.com/r/h1%3A397130.md).
- GraphQL query strings and API keys embedded in a JS bundle [E1](https://bugbountylibrary.com/r/h1%3A397130.md).
- Newly shipped features with their own path (e.g. `/policy_scopes`) and a named operation (`PolicyScopeAssetGroupsQuery`) [E2](https://bugbountylibrary.com/r/h1%3A1868473.md).
- Mutations that take an identity argument (`staffMemberId`) the caller can set freely [E3](https://bugbountylibrary.com/r/h1%3A905543.md).
- Operations that resolve data across all tenants/programs rather than scoping to the caller [E2](https://bugbountylibrary.com/r/h1%3A1868473.md).
- A `size`/pagination parameter that controls how much is returned [E2](https://bugbountylibrary.com/r/h1%3A1868473.md).

## How to review
For every operation in the schema, ask: what enforces the caller's identity and role *inside the resolver*? The invariant: each resolver must derive the caller from the authenticated session and filter results to objects that caller may see; no operation may trust a client-supplied identity or scope. Check that the route is behind auth middleware, not just the UI. Check that mutations verify the permission the action requires (not merely that the user is logged in) and ignore or validate client-supplied `staffMemberId`-style fields against the session [E3](https://bugbountylibrary.com/r/h1%3A905543.md). Check cross-tenant queries return only the caller's tenant [E2](https://bugbountylibrary.com/r/h1%3A1868473.md).

## How finders spotted it
- Noticed the site returned 200 and loaded content before redirecting to Okta; used view-source on the JS bundle, beautified it, found GraphQL query strings and an API key, then probed `/graphql` [E1](https://bugbountylibrary.com/r/h1%3A397130.md).
- Noticed a new scope-policy feature, appended its path to a program URL and saw the app break, then inspected the GraphQL request in Burp and manipulated the `size` parameter [E2](https://bugbountylibrary.com/r/h1%3A1868473.md).
- Noticed the POS app's cash-tracking mutation and tested it with a low-privileged token [E3](https://bugbountylibrary.com/r/h1%3A905543.md).

## Variants seen
- Unauthenticated read of third-party ticket data via a pre-auth GraphQL endpoint [E1](https://bugbountylibrary.com/r/h1%3A397130.md).
- Unauthenticated cross-tenant read of private program scopes, scaling with a size parameter [E2](https://bugbountylibrary.com/r/h1%3A1868473.md).
- Low-privileged mutation bypassing role checks plus identity spoofing [E3](https://bugbountylibrary.com/r/h1%3A905543.md).

## Impact and severity
Leaked private ticket contents (subjects, descriptions, requester names) [E1](https://bugbountylibrary.com/r/h1%3A397130.md); leaked private/invite-only program names and scopes, with DoS at large sizes [E2](https://bugbountylibrary.com/r/h1%3A1868473.md); unauthorized cash adjustments with spoofed staff attribution [E3](https://bugbountylibrary.com/r/h1%3A905543.md). Impact rises with cross-tenant reach [E2](https://bugbountylibrary.com/r/h1%3A1868473.md) and with mutations that move money or forge attribution [E3](https://bugbountylibrary.com/r/h1%3A905543.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A397130.md
- E2: https://bugbountylibrary.com/r/h1%3A1868473.md
- E3: https://bugbountylibrary.com/r/h1%3A905543.md