Summary by spectreghost
A NASA science data platform exposed data-ingestion API endpoints that accepted write operations from unauthenticated users.
The platform implemented an access control layer that correctly identified anonymous requesters as having no write permission, and that layer was enforced on some resources — an anonymous write to one model returned HTTP 403 with an explicit authorization denial. The same anonymous requester, however, could write to other models on the ingestion path, where the authorization check was never reached. Requests that failed did so on field validation rather than authentication, confirming there was no authentication boundary in front of the write handler.
I demonstrated the issue non-destructively by creating clearly marked test records containing no real or sensitive data. No existing records were modified or deleted, and no restricted data stores were accessed. All test records were reported for cleanup and removed.
A second, related finding was that the platform's data model schemas were readable without authentication, which supplied the field names required to construct a valid write request.