# Mass assignment of trusted flags

User-supplied params setting trusted, verified, role, or recovery fields on non-admin endpoints

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $5,580; latest 2026-07-02. Updated 2026-10-23._

## How it works
An endpoint binds request parameters directly onto a model or template, and that model carries fields the caller was never meant to control: `trusted`, `skip_consent`, `email`, role flags. The code assumes "the UI doesn't send this field" or "only admins reach this endpoint," but the binding layer accepts whatever the request contains. The trusted flag then changes downstream behavior — consent screens are skipped, recovery addresses are rebound, template variables are shadowed — so a low-privilege actor inherits a high-trust decision.

## Where it shows up
- OAuth/OIDC application update endpoints accepting `trusted`, `first_party`, `skip_consent` from group owners or app owners [E2](https://bugbountylibrary.com/r/h1%3A1148364.md)
- Profile/bio/save endpoints accepting `email`, `role`, `verified` while the UI renders them read-only [E3](https://bugbountylibrary.com/r/h1%3A3766455.md)
- Template engines auto-binding request params (`jvar_*`) that shadow template variables [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-three-bugs-to-access-all-your-servicenow-data.md)
- Two-phase evaluation with different delimiters/prefixes where one pass skips escaping [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-three-bugs-to-access-all-your-servicenow-data.md)
- Separate privacy toggles that each govern only one transport, leaving others on a default [E4](https://bugbountylibrary.com/r/blog%3Afeed-bugs-xdavidhu-me-bugs-0013.md)

## How to review
For every write endpoint, enumerate the model fields the handler can bind and compare against the fields the caller's role may legitimately set. The invariant: **the set of bindable fields must be a subset of the fields authorized for that caller's role, enforced server-side, independent of what the UI sends.** Replay the save request with read-only fields injected and confirm persistence on an independent backend (GraphQL vs REST) to rule out echo [E3](https://bugbountylibrary.com/r/h1%3A3766455.md). For OAuth, confirm consent is required unless the client was marked trusted by an instance admin, not a group owner [E2](https://bugbountylibrary.com/r/h1%3A1148364.md). For templates, confirm no request param reaches an unescaped sink [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-three-bugs-to-access-all-your-servicenow-data.md).

## Variants seen
- Group owner mass-assigns `trusted=1` on an OAuth app, skipping consent and minting an api-scoped token for any victim who clicks authorize [E2](https://bugbountylibrary.com/r/h1%3A1148364.md)
- Bio endpoint persists `email` despite locked UI, rebinding recovery email and chaining to account takeover [E3](https://bugbountylibrary.com/r/h1%3A3766455.md)
- Auto-bound `jvar_page_title` flows into a two-pass Jelly template, bypassing sanitizer and namespace mitigations [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-three-bugs-to-access-all-your-servicenow-data.md)
- A privacy toggle that silently doesn't govern the transport it claims, so personal results leak over Bluetooth on the lock screen [E4](https://bugbountylibrary.com/r/blog%3Afeed-bugs-xdavidhu-me-bugs-0013.md)

## Impact and severity
Full account takeover via recovery-email rebind [E3](https://bugbountylibrary.com/r/h1%3A3766455.md); silent token issuance for targeted users [E2](https://bugbountylibrary.com/r/h1%3A1148364.md); pre-auth access to all tenant data [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-three-bugs-to-access-all-your-servicenow-data.md); personal-data disclosure on locked devices [E4](https://bugbountylibrary.com/r/blog%3Afeed-bugs-xdavidhu-me-bugs-0013.md). Severity rises when the flag gates consent or recovery, when no re-authentication is required, and when the trusted value persists across sessions.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-three-bugs-to-access-all-your-servicenow-data.md
- E2: https://bugbountylibrary.com/r/h1%3A1148364.md
- E3: https://bugbountylibrary.com/r/h1%3A3766455.md
- E4: https://bugbountylibrary.com/r/blog%3Afeed-bugs-xdavidhu-me-bugs-0013.md