# Unauthenticated endpoint object exposure

Endpoints reachable without credentials that read or mutate records keyed by caller-supplied IDs

_Area: Web access control and IDOR. Seen in 12 disclosed reports; 6 confirmed bounties, median $4,500, range $802-$14,000; latest 2026-10-19. Updated 2026-10-23._

## How it works
A handler acts on a caller-supplied identifier (record ID, device serial, tenant, topic, build number) while assuming that reaching it implies authorization: the caller is logged in, is inside the network, or holds a secret. The broken assumption is that "authenticated" or "internal" equals "authorized for this object." Two distinct failures hide here: missing authentication (no principal at all) and missing object-level authorization (a principal exists but is never bound to the object). Decision test: strip credentials and replay. If it still works, it is missing authentication; if it works only with a second tenant's principal, it is missing object-level authorization.

## Where it shows up
- RPC methods with no resource ID in the path, skipping per-object auth middleware [E1](https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md)
- Public client keys (Supabase anon key, hardcoded API keys) as the sole gate [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md)
- Backends with Row Level Security or equivalent disabled [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md)
- Endpoints keyed only by deviceId/serial/UUID, or by document id plus connection id from the body [E4](https://bugbountylibrary.com/r/h1%3A676581.md)
- Notification/webhook handlers trusting a shared secret as bearer auth [E2](https://bugbountylibrary.com/r/h1%3A1170024.md)
- Anonymous AJAX handlers gated only by a nonce shared across all logged-out visitors [E3](https://bugbountylibrary.com/r/h1%3A3893632.md)
- Utility/download paths with numeric parameters (build_number) [E5](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-download-facebook-internal-mobile-builds.md)
- Loopback REST APIs of privileged desktop services [E7](https://bugbountylibrary.com/r/h1%3A858608.md)
- State/lifecycle endpoints accepting verbs like quiesce without auth [E8](https://bugbountylibrary.com/r/h1%3A993722.md)

## How to review
For each endpoint ask: what authenticates the caller, and what binds that caller to the object? The invariant: every read or mutation must verify the authenticated principal is authorized for the specific object or tenant, regardless of how the request reached the handler. Concretely: replay the request with cookies and auth headers stripped, then replay with a second tenant's principal and a foreign object ID. Confirm RLS/policy is enabled and tested with the public key [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md), that shared secrets and anonymous nonces are not treated as sufficient authorization [E2](https://bugbountylibrary.com/r/h1%3A1170024.md)[E3](https://bugbountylibrary.com/r/h1%3A3893632.md), and that loopback and lifecycle endpoints enforce a caller check [E7](https://bugbountylibrary.com/r/h1%3A858608.md)[E8](https://bugbountylibrary.com/r/h1%3A993722.md).

## Variants seen
- Global list RPC with no per-object auth [E1](https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md)
- Forged permission-change notification via leaked secret [E2](https://bugbountylibrary.com/r/h1%3A1170024.md)
- Anonymous nonce-gated AJAX leaking draft/private posts [E3](https://bugbountylibrary.com/r/h1%3A3893632.md)
- Document id plus connection id unbound to caller [E4](https://bugbountylibrary.com/r/h1%3A676581.md)
- Unauthenticated build artifact download [E5](https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-download-facebook-internal-mobile-builds.md)
- Missing RLS with public key [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md)
- Unauthenticated localhost config mutation [E7](https://bugbountylibrary.com/r/h1%3A858608.md)
- Unauthenticated lifecycle verb causing outage [E8](https://bugbountylibrary.com/r/h1%3A993722.md)

## Impact and severity
Ranged from bulk PII and full table read/write [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md)[E1](https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md) to protection bypass [E7](https://bugbountylibrary.com/r/h1%3A858608.md) and service outage [E8](https://bugbountylibrary.com/r/h1%3A993722.md). Severity rose with data volume, mutation capability, and cross-tenant reach; read-only leaks of low-sensitivity fields scored lowest. Note E5 is pure missing authentication on an admin utility, not object-level authz.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md
- E2: https://bugbountylibrary.com/r/h1%3A1170024.md
- E3: https://bugbountylibrary.com/r/h1%3A3893632.md
- E4: https://bugbountylibrary.com/r/h1%3A676581.md
- E5: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-download-facebook-internal-mobile-builds.md
- E6: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys.md
- E7: https://bugbountylibrary.com/r/h1%3A858608.md
- E8: https://bugbountylibrary.com/r/h1%3A993722.md