# Missing entitlement check on mutations

Mutations that confirm an object exists but never check the caller bought, owns, or is authorized for it

_Area: Web business logic and race conditions. Seen in 5 disclosed reports; 2 confirmed bounties: $2,000 and $2,000; latest 2026-09-23. Updated 2026-10-23._

## How it works
A mutation confirms the target object exists (and maybe that the caller can reference it) but never confirms the caller is entitled to it — purchased it, owns it, or holds the role the action requires. The gate lives in the UI flow or a newer endpoint, not in the resolver itself. The broken assumption is "if you can name it, you may act on it." A related shape: the check exists but a legacy path or a concurrent request slips past it.

## Where it shows up
- Mutations taking an object GID/ID where the resolver checks existence but not purchase/entitlement [E4](https://bugbountylibrary.com/r/h1%3A927567.md).
- Legacy or deprecated methods alongside newer ones that do enforce checks [E1](https://bugbountylibrary.com/r/h1%3A953083.md)[E4](https://bugbountylibrary.com/r/h1%3A927567.md).
- State-transition mutations (accept, review, publish) exposed to the wrong role, reachable via introspection though no UI exposes them [E2](https://bugbountylibrary.com/r/h1%3A2040756.md)[E3](https://bugbountylibrary.com/r/h1%3A1960107.md).
- Status/price parameters set by the client and trusted without binding to the acting party [E3](https://bugbountylibrary.com/r/h1%3A1960107.md).
- First-party consoles (GraphiQL) proxying admin GraphQL with broader scope than the UI [E5](https://bugbountylibrary.com/r/h1%3A1257428.md).
- Multi-step flows (install, publish) with no lock on object state [E1](https://bugbountylibrary.com/r/h1%3A953083.md).

## How to review
For each mutation, state the exact invariant: "caller purchased/owns this object AND holds the required role AND the policy gate passed." Trace the resolver, not the UI, and confirm the check is present there. Verify whether the resolver enforces entitlement for arbitrary IDs, not just the caller's own. Compare legacy and current resolver code paths for the same action and confirm both enforce the same gate [E1](https://bugbountylibrary.com/r/h1%3A953083.md)[E4](https://bugbountylibrary.com/r/h1%3A927567.md). Enumerate every path to the action — legacy methods, alternate endpoints, consoles — and check each [E3](https://bugbountylibrary.com/r/h1%3A1960107.md)[E5](https://bugbountylibrary.com/r/h1%3A1257428.md). For multi-step flows, confirm state is locked between steps so a concurrent request cannot act on a half-installed object [E1](https://bugbountylibrary.com/r/h1%3A953083.md).

## Variants seen
- Publish mutation checks theme ID ownership but not purchase, publishing a paid theme [E4](https://bugbountylibrary.com/r/h1%3A927567.md).
- Race during installation lets a legacy publish request land before purchase validation [E1](https://bugbountylibrary.com/r/h1%3A953083.md).
- Reviewer-only state-transition mutations callable by a customer to self-advance status [E2](https://bugbountylibrary.com/r/h1%3A2040756.md).
- Status-change endpoint lacks actor-role binding; the proposing party can also confirm [E3](https://bugbountylibrary.com/r/h1%3A1960107.md).
- Billing mutation reachable through a developer console despite documented permission restrictions [E5](https://bugbountylibrary.com/r/h1%3A1257428.md).

## Impact and severity
High: unpaid access to premium content [E1](https://bugbountylibrary.com/r/h1%3A953083.md)[E4](https://bugbountylibrary.com/r/h1%3A927567.md), workflow bypass letting a customer approve their own submission [E2](https://bugbountylibrary.com/r/h1%3A2040756.md), PII disclosure and overcharging in a two-sided marketplace [E3](https://bugbountylibrary.com/r/h1%3A1960107.md), and free credit minting [E5](https://bugbountylibrary.com/r/h1%3A1257428.md). Severity rises when the bypassed gate is a security or billing control, when the alternate path is easy to reach, and when the action affects other users' data.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A953083.md
- E2: https://bugbountylibrary.com/r/h1%3A2040756.md
- E3: https://bugbountylibrary.com/r/h1%3A1960107.md
- E4: https://bugbountylibrary.com/r/h1%3A927567.md
- E5: https://bugbountylibrary.com/r/h1%3A1257428.md