# Unauthenticated state-mutating handler

Routes that mutate state or spawn processes with no credential check before acting

_Area: Web access control and IDOR. Seen in 4 disclosed reports; latest 2026-06-18. Updated 2026-10-24._

## How it works
A handler that changes state or launches a process is mounted without an authentication check, so the code assumes "only trusted callers reach here" while nothing enforces it. Auth is either opt-in (off by default) or applied to sibling route groups but omitted on this one. The handler then acts on caller input directly: spawning a process, mutating topology, or running validation that can terminate the service.

## Where it shows up
- Route groups mounted without the auth middleware that sibling groups use; compare 401 vs 500 responses across groups on the same server [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md)
- Auth gated behind an opt-in flag (e.g. AUTH_ENFORCE) that defaults off [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p75f-6fp4-p57w.md)
- Default bind to 0.0.0.0 exposing the UI/API beyond localhost [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p75f-6fp4-p57w.md)
- "connect"/"create"/"delete" endpoints that accept a command, args, or config blob and act on it [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p75f-6fp4-p57w.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md)
- Wrapped third-party UI packages whose own route table and auth defaults differ from the wrapper [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p75f-6fp4-p57w.md)
- Type guards that wrap only part of a handler, leaving later calls unguarded [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)
- Request-time validation paths reaching Fatalf/os.Exit [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md)

## How to review
For every state-mutating or process-spawning route, confirm an authentication and authorization check runs before any side effect, and that it is on by default. Enumerate the route table of wrapped packages, not just the wrapper. Check that type/role guards cover every subsequent dereference and call, not only an async branch. Confirm validation failures return errors rather than terminating the process. The invariant: no side effect occurs until the caller's identity and authority are verified.

## Variants seen
- Unauthenticated command/args passed to a local process launcher [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p75f-6fp4-p57w.md)
- Unauthenticated delete mutating topology, then nil-deref panic [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)
- Unauthenticated create hitting Fatalf on bad input, exiting the process [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md)

## Impact and severity
Arbitrary local process execution as the service user [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p75f-6fp4-p57w.md); denial of service via panic [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md) or full process exit [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md). Severity rises with default 0.0.0.0 binding, opt-in auth, and fail-fast calls on attacker-influenced input.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-p75f-6fp4-p57w.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md