A GraphQL tag mutation acted on another user's asset
GraphQL does not move the authorization bug. Save one allowed mutation and one denied mutation on an object you do not own. Suggestions and introspection are inventory beside that pair.
- Original severity
- Medium (5.3) source-reported; not rescored by vulns.co
- Public source
- hackerone disclosure
- Program / vendor
- HackerOne
- Product / surface
- AddTagToAssets GraphQL operation
- Weakness
- Insecure direct object reference · CWE-639
- Affected boundary
- A caller and an asset identifier they do not own
- Disclosure date
- 2025-06-08
- Public status checked
- 2026-09-26
- Public attribution
- root_geek280
What the evidence established
The disclosed report describes a mutation that accepted another user's asset reference. A later retest on the public timeline says the fix held, and the report was then disclosed.
Why the impact was credible
The source reported that a tag could be applied to an asset outside the caller's authority.
Durable engineering lesson
GraphQL does not move the authorization bug. Save one allowed mutation and one denied mutation on an object you do not own. Suggestions and introspection are inventory beside that pair.
Control pattern
Authorize the object inside the mutation. Do not treat the operation name or a hidden identifier as the check.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-26.