Back to feed
Dev.to
Dev.to
7/21/2026
Missing Authorization Check in Next.js Server Actions Exposed User Resume Data

Missing Authorization Check in Next.js Server Actions Exposed User Resume Data

Original: The Door I Forgot to Lock, How One Missing Check Nearly Exposed Every Resume in My App

Short summary

A developer discovered a missing authorization check in their AI resume analyzer's Next.js server actions, allowing anyone to fetch other users' resume data by guessing an analysis ID. The bug existed because several server actions filtered only by record ID without verifying the requesting user's ownership. The fix involved adding Clerk's auth() checks at the start of every sensitive server action.

  • •IDOR vulnerability in Next.js server actions exposed other users' resume data
  • •Server actions are network endpoints underneath — frontend hiding is not security
  • •Fix: add Clerk auth() ownership checks to every sensitive server action

Generated with AI, which can make mistakes.

#ai-tools#ai-agents
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

I Found 4 Bugs in an AI Student Platform — Here's What Was Actually Wrong
Dev.to
4 Silent Failures, 2 Undocumented APIs, and a Container That Crashed Because of a Missing User Directive
Dev.to
My Next.js 16 Auth Passed Every Test. Five Bugs That Only Showed Up When I Wired It Together.
Dev.to
How a BOLA authorization flaw exposed all user data days after launch
Dev.to