---
id: 2755
title: "The Most Overlooked Server Permission Checks"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/most-overlooked-server-permission-checks"
published_at: "2022-06-23T16:00:00Z"
tags: ["access-control", "code-review", "api-security", "idor", "authorization", "django", "backend"]
phying_url: "https://phying.com/item/2755"
lang: en
---

# The Most Overlooked Server Permission Checks

## Summary

From hundreds of backend code reviews: common authorization pitfalls in a Python/Django API, where trusting user-supplied IDs without real permission checks exposes users' private repositories.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2022-06-23T16:00:00Z
- **Original:** https://www.hackerone.com/blog/most-overlooked-server-permission-checks
- **Phying News:** https://phying.com/item/2755