GraphQL IDOR and Batching Attacks for Bug Bounty Hunters

GraphQL IDOR and Batching Attacks for Bug Bounty Hunters

GraphQL collapses many REST endpoints into one. Authorization mistakes concentrate there too. Hunters who only fuzz REST miss node(id:) lookups, nested fields that skip ACL checks, and batching that turns one request into a hundred object reads.

Start with introspection (when allowed)

If introspection is open, dump types and note anything with id, user, account, secret, admin. If closed, learn the schema from the frontend: persisted queries, Apollo traces, or mobile apps often ship operation documents.

I keep a notebook of operation names and the IDs they touch.

IDOR on global IDs

Many apps use Relay-style global IDs (base64 of Type:dbId). Decode them. Swap the numeric part between User A and User B. Query node or type-specific fetchers as B with A’s ID.

Nested checks fail often: you cannot list B’s orders, yet order(id: A_ORDER) { customer { email } } still resolves. Walk field by field.

Mutations deserve the same swap — update, delete, share, regenerateApiKey.

Batching and aliases

GraphQL batching (array of queries) or aliases (u1: user(id:"1") u2: user(id:"2")) can:

• Bypass per-IP rate limits meant for REST
• Amplify IDOR into bulk extraction in one HTTP call
• Stress CPU (DoS) — report carefully; programs often want a gentle alias proof, not a takedown

Show 3–5 aliases reading objects you own vs one unauthorized object. That demonstrates the pattern without scraping.

Tips that saved me time

• Compare errors: “not found” vs “not authorized” (enumeration)
• Try field suggestions from validation errors
• Watch for separate auth on subscriptions/WebSocket GraphQL
• CSRF on GraphQL POSTs if cookies back the session

Report and fix language

Cite the exact operation and variables. Recommend object-level auth in resolvers (not only at the HTTP gateway), disable or limit batching/aliases, and turn off introspection in production if policy requires.

GraphQL IDOR is BOLA with a query language. Batching is how a single hole becomes a hose — prove both with small, owned datasets.