larisku
ID Discuss a project

SECURITY RESEARCH BY EL1SYUM / Credential lifecycle / historical publication

Descendant token survives delegation revocation

The source records a rejected source credential after revocation while its descendant still changed a nonsensitive marker verified by the owner.

All case studies ←

01 / OVERVIEW

The case at a glance.

Offboarding needs to cover access issued during a delegation. The source explains why descendant tokens must be checked alongside the original user's access.

Date / archive
Archived 15 September 2026; test date not stated
Scope
A legitimate delegation and researcher-owned disposable objects/account; sensitive identities and artifacts: ***.
Risk
Medium — classification in the historical publication
Evidence confidence
Validated according to the publication; raw artifacts absent from this backup

02 / TESTED SURFACE

Follow the access boundary.

A legitimate delegation and researcher-owned disposable objects/account; sensitive identities and artifacts: ***.

The publication compares parent and descendant before/after revocation, retains a denied comparison scope, then reads the marker through a separate owner session.

  1. User / token
  2. Web / API surface
  3. Server decision
  4. Resource / state

Conceptual surface map. The scope and evidence above specify which parts were actually examined.

03 / BUSINESS CONTEXT

Connect permissions
to business decisions.

Offboarding needs to cover access issued during a delegation. The source explains why descendant tokens must be checked alongside the original user's access.

The source states BOUNDARY_CROSSED. The marker was restored, the descendant was deleted and rejected, and inventory returned to baseline.

04 / HOW ACCESS WORKS

A pass identifies a visitor.
A permission opens a room.

Educational building analogy
  1. IdentityThe visitor carries a pass.
  2. AuthenticationThe building identifies the visitor.
  3. AuthorizationPermission determines which door opens.
  4. ResourceThe room, data, or feature.

Login establishes who you are. Authorization determines what you may access.

Application flow for technical readers
  1. Browser → Frontend
  2. AuthenticationVerifies user identity.
  3. SessionMaintains authentication state.
  4. AuthorizationChecks permission for an action and resource.
  5. API / ControllerConnects client requests to application logic.
  6. Data layerHolds protected resources.

A general application model, not a source-code reconstruction of this target.

05 / SECURITY QUESTION

Does revoking a delegation also end the authority created through that delegation?

EXPECTED

  1. User
  2. Authenticated
  3. Authorization check
  4. Ownership / permission check
  5. Allowed resource

POTENTIAL FAILURE

  1. User
  2. Authenticated
  3. Request object
  4. Missing / incorrect authorization
  5. Unauthorized resource

Educational comparison. A potential failure is not a finding against a target unless the case evidence confirms it.

06 / EVIDENCE

Read the status
with its evidence.

Validated according to the publication; raw artifacts absent from this backup

VALIDATED
According to the publication: the source credential was rejected after revocation; the owner confirmed the descendant's marker from server state.
OBSERVED
The descendant remained Restricted and the comparison scope remained denied.
NOT VERIFIED
Independent reproduction, current exposure, and remediation retesting.
NOT AVAILABLE
Raw HTTP, owner inventory, and engagement artifacts are absent from this website backup.
  1. Observation
  2. Reproduction
  3. Validation
  4. Impact confirmation
  5. Finding

The ladder shows the standard of proof, not completed stages. The status ledger above records what is available for this case.

07 / TECHNICAL BREAKDOWN

Controls, behavior,
and verification.

Actor
A principal given a temporary delegation through the normal workflow.
Control boundary
The source delegation lifecycle versus descendant credentials.
Root cause
The publication states that descendant credentials were not bound to source authority lineage; backend source is not included.
Recorded effect
A nonsensitive researcher-owned marker changed after revocation and was confirmed through an owner session.
CWE / retest
Not independently verified from this website backup.

Fix note / owner verification

Record credential authority lineage and apply cascade revocation or explicit owner approval for persistent grants.

A direction for review; implementation and completed remediation are not claimed.

08 / LIMITATIONS

The limits belong
in the result.

  • No admin, cross-tenant, payment, or paid-resource claim; descendant scope remained restricted.
  • The owner legitimately granted initial access; the minimum recorded effect was a nonsensitive field mutation.
  • Raw evidence and test dates are absent from the backup; it cannot establish current exposure.

09 / OUTCOME

What the case establishes.

The source states BOUNDARY_CROSSED. The marker was restored, the descendant was deleted and rejected, and inventory returned to baseline.

10 / LESSONS & REFERENCES

A rejected original principal does not establish that all descendant tokens and sessions have ended.

Source: a redacted public article in the website backup dated 15 September 2026.

insight-descendant-token-lifecycle.php

Security review services ↗Discuss your scope ↗