# Weaker permission satisfies privileged check

Permission checks that pass with weaker, empty, or unawaited credentials than the action requires

_Area: Web access control and IDOR. Seen in 2 disclosed reports; latest 2026-06-25. Updated 2026-10-24._

## How it works
A privileged action is guarded by a check that is satisfied by something weaker than intended. The guard may test a lesser permission, an empty requirement set, a truthy-but-unresolved async result, or skip ownership/password verification entirely. The action then runs for an identity that should never reach it. The broken assumption is that "the check ran" equals "the right check ran."

## Where it shows up
- Permission classes or decorators built conditionally from config flags, especially branches that produce an empty requirement set [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qcqw-jwxc-2hqg.md)
- Handlers authorizing with a weaker verb (e.g. `update`) where a stronger one (`manageUsers`) is required [E1](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md)
- Async security checks (`validatePassword`, `bcrypt.compare`) whose Promise/result is not awaited [E1](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md)
- Admin-console routes on shared controllers gated at controller level, not per action [E4](https://bugbountylibrary.com/r/h1%3A2197796.md)
- Settings permissions (SMTP, webhooks, integrations) that redirect secrets-bearing mail [E3](https://bugbountylibrary.com/r/h1%3A2279010.md)
- Guest/order/address lookups keyed only by an identifier with no ownership check [E1](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md)

## How to review
For each sensitive action, state the exact invariant: the identity must hold the specific permission the action needs, own the object, and have passed any password/async check to completion. Then verify:
- The permission set is non-empty and the strongest required Need is present; empty needs must deny, not allow [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qcqw-jwxc-2hqg.md)
- Every async auth result is awaited and its resolved value tested [E1](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md)
- Each route on a shared controller has its own role gate [E4](https://bugbountylibrary.com/r/h1%3A2197796.md)
- Object access checks ownership, not just existence [E1](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md)
- Config permissions cannot redirect secrets to attacker-controlled destinations [E3](https://bugbountylibrary.com/r/h1%3A2279010.md)

## Variants seen
- Weaker verb authorizes stronger operation [E1](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md)
- Empty Need set treated as allow-all [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qcqw-jwxc-2hqg.md)
- Unawaited async check returns truthy Promise [E1](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md)
- Adjacent config permission leaks secrets [E3](https://bugbountylibrary.com/r/h1%3A2279010.md)
- Controller-level auth without per-action role gating [E4](https://bugbountylibrary.com/r/h1%3A2197796.md)

## Impact and severity
Escalation from read-only or editor to root/admin, account takeover, and PII exposure [E1](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qcqw-jwxc-2hqg.md)[E4](https://bugbountylibrary.com/r/h1%3A2197796.md). Severity rises when the weaker permission is common, the action is destructive (root CA creation, admin password reset), or secrets flow through redirected channels [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qcqw-jwxc-2hqg.md)[E3](https://bugbountylibrary.com/r/h1%3A2279010.md)[E4](https://bugbountylibrary.com/r/h1%3A2197796.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-qcqw-jwxc-2hqg.md
- E3: https://bugbountylibrary.com/r/h1%3A2279010.md
- E4: https://bugbountylibrary.com/r/h1%3A2197796.md