“This is a patch bypass of a previously fixed authorization issue, indicating incomplete remediation.”
Summary
A previously fixed access control issue can still be bypassed using a multi-user sharing chain, allowing unauthorized modification of the original owner’s permissions.
Affected Platform
https:
Vulnerability Type
Access Control Bypass
Authorization Logic Flaw
Description
Although the application now prevents direct re-invitation of the original owner (returning 403 Forbidden), this protection can be bypassed by involving additional users.
An attacker can leverage a third user (or admin account) to indirectly reassign permissions of the original owner, effectively bypassing the intended restriction.
Steps to Reproduce
User-1 (Owner) creates a note.
User-1 shares the note with User-2 (with share permissions).
User-2 attempts to re-invite User-1 → ❌ Blocked (403) (fix applied).
User-2 shares the same note with User-3.
User-3 now invites User-Admin (user-1).
From this new context, modify permissions of User-1 (Owner).
Observe:
The server accepts the request.
Original owner’s permissions can again be altered.
Impact
Complete bypass of the previous security fix.
Unauthorized users can:
Modify owner permissions
Potentially downgrade or restrict the owner
Breaks trust model of access control.
Can lead to loss of ownership control and data integrity issues.
Expected Behavior
Owner permissions should remain immutable, regardless of sharing chains.
Access control checks should be enforced consistently across all user relationships.
Actual Behavior
Access control is only partially enforced.
Indirect sharing allows bypass of restrictions.
Severity
High
Recommendation
Enforce strict ownership validation at backend level.
Apply permission checks based on original ownership, not sharing path.
Prevent any role modification targeting the original owner from any user.
Normalize permission logic across all sharing scenarios.
Note
This issue demonstrates that the previous fix is incomplete and can be bypassed using chained sharing between multiple users.