Laboratory journal. This note traces method, data flow, and mitigation. It does not include exploit instructions, payloads, or reproduction against live systems.
01
Executive Summary
APIs fail at the object, not at the login. This note is the method we use to research authorization: two principals, one object, and a predicate that must fail closed.
We do not publish tenant-takeover recipes. We publish how to see the missing predicate.
02
Vulnerability
Broken object-level authorization, broken function-level authorization, and mass assignment of role or tenant fields. These are distinct. A note that mixes them is not finished.
03
Affected Software
REST and GraphQL APIs, partner webhooks, mobile BFF layers, and AI tool-calling gateways that forward object IDs to internal services.
04
Attack Surface
GET/PATCH/DELETE on /resource/{id}, batch endpoints, search that returns other tenants, export jobs, and GraphQL nodes that resolve by global ID.
05
Root Cause
The service trusted the object ID from the client and applied authentication only. Root cause is the missing (principal, object, action) check at the data layer.
06
Data Flow
If the data layer can load an object without the principal, the API will eventually leak it through a new handler.
- → Authenticated request
- ↓ Client-supplied object ID
- ↓ Handler
- ↓ Data load (with or without tenant predicate)
- ↓ Response or privileged side effect
07
Why It Becomes RCE
API authorization failures become RCE only when the exposed operation installs code, evaluates templates, or drives a deserializer. Otherwise the impact is confidentiality or integrity of tenant data. Keep the label honest.
08
Patch Analysis
Strong patches push the predicate into the query or policy engine used by all handlers. Weak patches add an if-statement on one controller. Count remaining loaders of the same model.
09
Detection
Two-tenant tests on every object route. Static review of queries that take a raw ID. Monitor cross-tenant access denials — and the absence of denials on object routes.
10
Mitigation
Bind every load to the session tenant. Deny by default on new handlers. Do not accept role or org ID from the body. Treat batch and export as the same authorization problem as a single GET.
11
Lessons Learned
Authorization research is slow on purpose. One confirmed missing predicate is worth more than a page of hypothetical IDOR.
12
References
OWASP API Security Top 10 — API1 and API5 as starting labels, after evidence.
Art of Vector Security disclosure policy — /about/responsible-disclosure.
Continue
- 05 — Authentication → Authorization → Privilege Escalation
CVE to Real Risk
- 06 — SSRF: From URL Parser to Server-Side Impact
CVE to Real Risk
- 10 — CVE to Exploitability: Measuring Real-World Risk
CVE to Real Risk