PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Most Overlooked Server Permission Checks

hackerone.com | blog | #access-control | #code-review | #api-security | #idor | #authorization | #django | #backend
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

From hundreds of backend code reviews: common authorization pitfalls in a Python/Django API, where trusting user-supplied IDs without real permission checks exposes users' private repositories.
Published
Collected

Related coverage

blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
blog · xbow.com
Getting to “Should I?”, Instead of “Can I?”: How XBOW Finds IDORs With High Accuracy in Ambiguous Contexts
XBOW explains why IDORs are design flaws that scanners miss, and how its context-aware reasoning models expected access patterns to find high-accuracy IDORs in ambiguous authorization contexts.
blog · xbow.com
Tales From the Trace: How XBOW Reasons Its Way Into Finding IDORs
Walks through XBOW traces that found two IDORs in the Spree e-commerce framework (CVE-2026-22588/22589, patched in v5.2.5) by reasoning about objects and authorization states.
blog · about.gitlab.com
Two front doors: Module-level access in a Django GRC app
A technical deep-dive on restructuring a Django internal tool to support two distinct GitLab teams: Security Compliance and Internal Audit.
blog · bugcrowd.com
How-To: Find IDOR (Insecure Direct Object Reference) Vulnerabilities for Large Bounty Rewards
Guest researchers Mert and Evren explain how IDOR lets attackers manipulate id or uid parameters to access other users' objects, and share testing tips using browser session isolation and Burp Suite.
blog · borghq.io
IDOR Testing for APIs: How to Find Broken Object Access
IDOR testing for APIs, done as an authorisation check on every object reference. Two-account setup, every operation, and how to make it repeatable per release.
Back