# Weaker permission unlocks privileged operation

Does a weaker, implied, or per-object grant satisfy a check meant for a stronger permission?

_Area: Web access control and IDOR. Seen in 5 disclosed reports; one confirmed bounty: $1,900; latest 2026-04-10. Updated 2026-10-23._

## How it works
A privileged action is meant to require a strong permission, but the guard accepts a weaker one that is true for the caller. The broken assumption: the guard checks a permission that is not the one the action needs, and the caller's effective rights are broader than what they hold. Concretely, the guard names a derived permission whose policy chain inherits from a broader grant [E2](https://bugbountylibrary.com/r/h1%3A1375393.md); a per-object grant satisfies a global feature check [E1](https://bugbountylibrary.com/r/h1%3A1555502.md); a negated guard contains a clause trivially true for the target [E5](https://bugbountylibrary.com/r/h1%3A3020021.md); or a permission implied for one purpose (unshare) is forwarded when the caller re-grants access [E6](https://bugbountylibrary.com/r/h1%3A633245.md). A related failure is missing subset-validation: a caller updating permissions on a grant they hold can raise it beyond their own rights [E3](https://bugbountylibrary.com/r/h1%3A619484.md).

## Where it shows up
- Endpoints gated on a derived permission (approve) whose policy chain inherits from a broader one (update) held by low roles [E2](https://bugbountylibrary.com/r/h1%3A1375393.md)
- Per-resource grants (single-app access) satisfying a global feature check [E1](https://bugbountylibrary.com/r/h1%3A1555502.md)
- Destructive actions reachable via adjacent operations (move/transfer/archive) that skip the delete check [E4](https://bugbountylibrary.com/r/bc%3A598061cf-5339-4684-9fb0-412db75521d1.md)
- Negated deny-condition OR-chains where one clause is trivially true for the target object, collapsing the guard [E5](https://bugbountylibrary.com/r/h1%3A3020021.md)
- Share-update endpoints that don't require new permissions to be a subset of the caller's own [E3](https://bugbountylibrary.com/r/h1%3A619484.md)
- Implied permission bits (added for unshare) forwarded blindly on reshare [E6](https://bugbountylibrary.com/r/h1%3A633245.md)

## How to review
For each privileged action, name the exact permission it needs and trace the policy chain to every role/grant that enables it. Invariant: the checked permission must be the one the action needs, and no weaker, implied, or per-object grant may satisfy it. For share/permission updates, confirm requested permissions are a subset of the caller's effective permissions on the node. For implied bits, check they are re-validated, not forwarded, on reshare. For destructive actions, enumerate every operation reaching the same end state and confirm each enforces the same check. For negated guards, verify no clause is trivially true for the target.

## Variants seen
- Derived permission inheriting from broader role grant via policy chain [E2](https://bugbountylibrary.com/r/h1%3A1375393.md)
- Per-object grant satisfying global feature check [E1](https://bugbountylibrary.com/r/h1%3A1555502.md)
- Adjacent operation bypassing destructive-action permission [E4](https://bugbountylibrary.com/r/bc%3A598061cf-5339-4684-9fb0-412db75521d1.md)
- Inverted negated-OR guard collapsing the check [E5](https://bugbountylibrary.com/r/h1%3A3020021.md)
- Missing subset-validation on share update [E3](https://bugbountylibrary.com/r/h1%3A619484.md)
- Implied unshare permission propagated on reshare [E6](https://bugbountylibrary.com/r/h1%3A633245.md)

## Impact and severity
Led to spoofed status checks on merge requests [E2](https://bugbountylibrary.com/r/h1%3A1375393.md), unauthorized app install [E1](https://bugbountylibrary.com/r/h1%3A1555502.md), cross-workspace board destruction [E4](https://bugbountylibrary.com/r/bc%3A598061cf-5339-4684-9fb0-412db75521d1.md), unauthorized state changes [E5](https://bugbountylibrary.com/r/h1%3A3020021.md), and write/delete escalation on shared files [E3](https://bugbountylibrary.com/r/h1%3A619484.md)[E6](https://bugbountylibrary.com/r/h1%3A633245.md). Severity rises when the weaker grant is broadly held (Guest, normal member) and the outcome is data loss or unauthorized state change.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1555502.md
- E2: https://bugbountylibrary.com/r/h1%3A1375393.md
- E3: https://bugbountylibrary.com/r/h1%3A619484.md
- E4: https://bugbountylibrary.com/r/bc%3A598061cf-5339-4684-9fb0-412db75521d1.md
- E5: https://bugbountylibrary.com/r/h1%3A3020021.md
- E6: https://bugbountylibrary.com/r/h1%3A633245.md