# Signed storage capability exceeds its authorized scope

The application issues or accepts a storage capability for an object, operation or lifetime beyond the caller's entitlement.

**Candidate CWE:** [CWE-863](https://cwe.mitre.org/data/definitions/863.html)

## Test hypothesis

Compare normal signing for A's fixture with signing for B's owned fixture. Separately compare the allowed method/key and the documented expiry case, changing one input at a time.

## Evidence required

A's identity, B's ownership, issuance request, capability scope, timestamps and successful canary operation. Redact the usable signature.

## Rule out false positives

A legitimately issued presigned URL works without the user's session, is reusable before expiry, or lasts within the explicitly documented sharing policy.

## Playbook and command references

- [Object storage, signed URLs and delivery boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/storage-delivery.html) — Follow one private canary through upload, signing, CDN delivery and expiry without enumerating real objects.
- [Azure and GCP: identity, delegation and storage access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html) — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Object%20storage%2C%20signed%20URLs%20and%20delivery%20boundaries)

## Referenced by these target playbooks

[Cloud & containers](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/cloud.html) · [Web & API](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web-api.html) · [OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

- [T1530 · Data from Cloud Storage](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html#T1530) — **Only if:** A demonstrated authorization or configuration failure permits collection of a controlled confidential object from an actual cloud storage service, including supported SaaS storage contexts. **Not established by:** A bucket name, public-by-design file, general BOLA, or any API response simply hosted in the cloud is insufficient. Establish the storage context and protected data boundary.

## Primary references

- [S3 presigned URL semantics](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)