Bulk Operations Verify Per-Resource Permissions

Bulk operations that accept an array of IDs and apply WHERE id IN (ids) without scoping to the authenticated user allow cross-user interference: user A includes IDs belonging to user B in their batch and the operation succeeds. CWE-639 (Authorization Bypass Through User-Controlled Key) applies directly — the user controls the ID set. CWE-284 covers the broader access control failure. OWASP A01 flags this as a broken access control pattern. A single bulk-delete endpoint without ownership scoping can allow an authenticated attacker to delete data belonging to any other user in the system.

Include the user ownership constraint in the bulk operation's WHERE clause — not as a pre-validation step, but atomically with the operation itself.

// app/api/tasks/bulk-delete/route.ts
const { ids } = await req.json();

// Ownership filter is part of the query — not a pre-check
const result = await db.task.deleteMany({
  where: {
    id: { in: ids },
    userId: session.user.id,   // Only affects records the user owns
  },
});

// result.count < ids.length means some IDs didn't belong to the user — silently ignored

This pattern is safer than a pre-validation loop because it cannot be bypassed by a race condition between the check and the operation.