Access control and data isolation
Object fetched by id without an ownership check
An endpoint checks that the caller is logged in, then returns whatever id was requested.
Termsrow-level security (database rules that decide which rows each signed-in user may read or write) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · API (the interface other software calls; tested directly, without the UI in between)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Authentication is easy to generate; authorization needs the product's ownership model. The 15-app study reports agents struggled as authorization logic grew more complex, and Next.js docs single out this check for server actions.
Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.
Source: Tenzai, 2026-01 · verified 2026-09-21
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
How we detect it
Call every id-bearing endpoint as user B with an id owned by user A.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Object access checks ownership, not only login
automated For each endpoint or action that takes an id, call it as a logged-in user with an id owned by another user.
Every id-bearing endpoint returns 403 or 404 for a foreign id; none returns the object.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in access control and data isolation
- critical
- critical
- critical
- critical
- critical
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.