RAG Permission Bypass: When Retrieval Ignores Document-Level Access Control

RAG permission bypass is SSA descriptive wording for a security-relevant gap between the access control a document carries in its source system and the access control a retrieval-augmented pipeline actually enforces when it serves that document's content into an agent's context. The defining cause is a confused-deputy pattern: a RAG service account typically needs broad read access across a document corpus to build and refresh its index, and when that broad access is not re-checked against the entitlement of the specific user issuing a query, any authenticated user's question can ride the service account's own privilege to a document that user could never open directly. Two documented sources show this gap at different points two years apart: the 2024 ConfusedPilot research against Microsoft 365 Copilot, and a 2026 broken-access-control CVE in a commercial RAG feature.

What it is

The defining object is the entitlement metadata a source system, a SharePoint site, a wiki, a ticket system, a shared drive, attaches to a document: who is and is not allowed to open it. The defining mechanism is what happens to that metadata when the document is ingested into a retrieval index. An indexing pipeline commonly authenticates as one broad-scope service identity to crawl and embed everything it is pointed at, and if that pipeline does not also persist a per-document or per-chunk entitlement record, or if the retrieval step that later answers a user's query does not re-check the querying user's own entitlement against that record, the index becomes a single pool with the service account's access level, not the union of each individual user's own access level. The defining consequence is that a query from a lower-privileged user can surface the contents of a document only a higher-privileged user was supposed to read, with no error, no denied-access message, and no log entry that looks like an authorization failure, because from the pipeline's point of view no authorization check ever ran.

This differs from a database or file-server permission bug in one important respect: the entitlement information is frequently present somewhere in the pipeline, attached to the source document, and simply does not travel with the content once it becomes an embedding or an indexed chunk. The loss happens at a specific, identifiable seam, ingestion-time flattening or retrieval-time omission, rather than from a complete absence of any access-control system anywhere in the stack.

What it is not

RAG poisoning, where the retrieved content is adversarial because an attacker planted or altered it to steer an answer. RAG permission bypass can serve content that is entirely legitimate and unaltered; the failure is that it reaches a reader never entitled to see it, not that the content itself was tampered with. The two can compound, an attacker's planted document can also exploit this same enforcement gap, but the defining cause here is the missing authorization check, not the content's authenticity.
MCP confused deputy and token passthrough, a different confused-deputy instance targeting OAuth token audience and consent state across MCP servers. That entry's trust boundary is a token issued for one audience being forwarded to another; this entry's trust boundary is a document's own access control list failing to travel from a source system into a retrieval index.
A retrieval system returning a stale or low-quality document with no access-control dimension involved, a relevance problem, not this working term.
A reproducible bypass payload tuned to a specific vendor's current index implementation.
Training-data membership inference or any attack that targets model weights rather than a runtime retrieval pipeline.

In scope

Indexing pipelines that authenticate with one broad-scope service identity and do not persist each source document's per-document or per-chunk entitlement alongside its embedding.
Retrieval paths that return the top-matching chunks to a query without re-checking the requesting user's own entitlement against the source system at answer time.
Confused-deputy dynamics in which a lower-privileged user's ordinary query inherits a RAG service account's broader indexing access.
Stale-index confidentiality failures, where a document deleted or access-revoked in its source system is still retrievable because the index has not been re-synchronized.
Defensive controls for entitlement propagation, entity- or chunk-level filtering, and index freshness relative to source-system revocation events.

Target state, trust boundary, and persistence

The target state is the retrieval pipeline's own authorization-enforcement boundary, the tool and environment layer that decides whether a matched chunk is allowed to reach a given session's context, independent of whether that chunk's content is itself trustworthy. The trust boundary that fails is the assumption that because a RAG service account is permitted to index a corpus, every user who can query that service inherits equivalent read access to everything in it, an assumption that holds only if the pipeline performs a second, per-query authorization check the indexing step's own access does not substitute for.

Persistence runs from session to shared-system. A single bypassed query is a session-scoped exposure for the one user who asked it, but the underlying condition, an index with no entitlement metadata or a retrieval path that never consults it, is a standing property of the deployment that will reproduce the same exposure for the next matching query from any user, not only the one who happened to trigger the first finding.

What the research and documented cases establish

ConfusedPilot, published by Ayush RoyChowdhury, Mulong Luo, Prateek Sahu, Sarbartha Banerjee, and Mohit Tiwari of UT Austin's Spark Research Lab (arXiv 2408.04870, v1 2024-08-09, v5 2024-10-23), names the class directly: "RAG models are especially susceptible to the confused deputy problem," which the paper's own shorthand defines as "a less privileged entity confuses a more privileged entity to act on its behalf." The paper's worked integrity attack has an insider upload a fabricated document containing both false figures and an embedded instruction such as one claiming authority over other documents; because, in the paper's words, "LLM cannot distinguish the embedded document from the original prompt," the model follows the planted instruction and answers from the fake document alone. Two further cases target confidentiality through index staleness rather than planted content: the paper states that Copilot's retrieval mechanism "caches already deleted document," so a document removed from its source can still be cited, and that even after a confidential document's access is revoked, "the confidential document can still be presented in the output of Copilot" because background indexing had already captured it, a gap the paper attributes partly to a compliance check that "does not check whether the information is from a deleted document." The research was demonstrated against Microsoft 365 Copilot and publicly disclosed at DEF CON's AI Village, per Symmetry Systems' own account of the work, which also cites a Microsoft-sourced figure that 65% of Fortune 500 companies were implementing or planning RAG-based AI systems at the time (arXiv 2408.04870, ConfusedPilot: Confused Deputy Risks in RAG-based LLMs; Cloud Security Alliance, ConfusedPilot: UT Austin, Symmetry Systems Uncover Novel Attack on RAG-Based AI Systems).

A 2026 CVE shows the same class of gap, independently, in a different commercial product. CVE-2026-21836 affects HCL DominoIQ version 14.5.1's RAG feature: the vendor's own description states that "document level access restrictions will be ignored when determining what data to return from an AI query," which could let an authenticated, low-privileged attacker view sensitive data through AI queries alone. The flaw is classified under CWE-862, Missing Authorization, carries a CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, confidentiality-only impact requiring no user interaction, and was published 2026-05-20 with a vendor fix available through HCL bulletin KB0130932 (CVE Record, CVE-2026-21836; Lutra Security Fieldguide, CVE-2026-21836; HCL Software Support, KB0130932).

Industry guidance treats this as an architectural pattern rather than a one-off defect. Okta's May 2026 guide to securing RAG workflows states plainly that "an agent with valid credentials can surface documents that the requesting user is not authorized to access" and that this happens "without triggering traditional access-control flags," recommending that deployments "enforce authorization at query time" and "propagate user context across every retrieval hop" rather than trust the indexing identity's own scope (Okta, How to Secure RAG Workflows). A 2026 systematic review of RAG security threats and defenses separately lists dynamic access control among the input-side protection mechanisms the field has proposed, alongside encryption-based and adversarial-filtering approaches, evidence that the research community treats enforcement at the retrieval boundary as a distinct, still-open defense category rather than a solved problem (arXiv 2603.21654, Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks).

Detection: observable signs

A query answer includes content traceable to a source document the requesting user cannot open directly in the source system when independently checked.
An answer cites or quotes a document that has since been deleted or had its access revoked in the source system.
Retrieval logs show the same index entry served to sessions with materially different entitlement levels, with no per-user filtering step recorded at query time.
The RAG service account's own read scope in the source system is visibly broader than any individual user's entitlement, with no corresponding per-query authorization check documented in the pipeline's design.
An index or vector store contains no persisted entitlement or access-control metadata per document or chunk, so there is nothing available to check against at query time even if a check were added later.

Defenses, containment, and recovery

The table below is SSA editorial guidance for defenders. It is neither a standard requirement nor a measured effectiveness ranking.

Control	Transition it interrupts	Applicability	Residual risk and verification
Propagate the requesting user's own identity and entitlement through every retrieval hop, and re-check it at query time instead of trusting the indexing service account's broader scope	A query inheriting the indexing identity's broad access instead of the querying user's own, narrower access	Any RAG pipeline where indexing and querying share one service identity	Requires every connector and middleware hop in the pipeline to carry identity context end to end; one hop that drops it reopens the gap.
Persist per-document or per-chunk entitlement metadata at ingestion time, and filter retrieval results against it before they reach the model's context	A retrieval match surfacing content with no entitlement record at all to check against	Any indexed corpus drawn from a source system with document- or folder-level permissions	Granularity adds index complexity and refresh cost; a document that mixes public and restricted sections needs chunk-level, not document-level, metadata.
Re-synchronize the index on a schedule tighter than practical query volume whenever a source document is deleted or its access is revoked	A stale index continuing to serve confidentiality-restricted content after the source system has already revoked it	Any RAG corpus with a document deletion or access-revocation workflow in its source systems	A window between revocation and re-index removal remains regardless of schedule; monitor specifically for queries landing inside that window.
Audit whether a deployment's own compliance or approval layer checks for deleted or access-revoked source content, not only live documents	A separate compliance gate approving output sourced from content that should already be unreachable	Any RAG deployment with a distinct compliance or approval-review layer, as the ConfusedPilot cases describe	The audit is a point-in-time check against current vendor behavior; re-verify after any vendor update to indexing or compliance logic.
Treat "who may query this RAG service" and "what that specific query is entitled to retrieve" as two separate authorization decisions, never inferred one from the other	Service-level query access being silently treated as equivalent to retrieval-content access	Any deployment offering RAG-backed answers to more than one user with differing entitlements	Largely an architectural and review discipline rather than a single technical control; it does not by itself add the per-query check, only the requirement to build one.

Prevention should treat ingestion and retrieval as two separate authorization moments, each requiring its own check, rather than letting the indexing identity's own access stand in for the querying user's. Detection should compare what an answer actually surfaced against what the requesting user could independently open in the source system, since neither CVE-2026-21836 nor the ConfusedPilot cases produce an error message a monitoring system would catch by default. Containment should suspend the affected RAG feature or quarantine the implicated index entries the moment a bypass is suspected, since, per CVE-2026-21836's own CVSS vector, the exposure requires no user interaction and reproduces on every subsequent matching query. Recovery should re-verify every answer traceable to the affected index segment, not only the one that surfaced the finding, and should confirm the index has been re-synchronized against current source-system entitlements before resuming the feature.

Boundaries with similar concepts

This differs from RAG poisoning in what fails. RAG poisoning's defining cause is adversarial content that was planted or altered to steer an answer; the content itself is the compromised object. RAG permission bypass's defining cause is an authorization check that never ran; the content can be entirely genuine, and the compromise is in who received it.

This also differs from MCP confused deputy and token passthrough in the object whose trust is misapplied, even though both are confused-deputy patterns. That entry concerns an OAuth token issued for one audience being accepted or forwarded by a different one. This entry concerns a document's own access control list failing to survive the trip from a source system into a retrieval index, with no token or OAuth exchange necessarily involved at all.

Mapping to standards and research

Source	Source-owned term or item	Relationship to this article
arXiv 2408.04870 (RoyChowdhury, Luo, Sahu, Banerjee, Tiwari)	ConfusedPilot	Primary-source origin of the confused-deputy framing for RAG systems, and documented integrity and confidentiality cases against Microsoft 365 Copilot.
CVE Program / NVD	CVE-2026-21836; CWE-862	Primary-source evidence of a fixed, vendor-acknowledged broken-access-control defect in HCL DominoIQ's RAG feature.
OWASP GenAI Security Project	Top 10 for Agentic Applications 2026, `ASI03:2026 Identity and Privilege Abuse`	SSA-selected OWASP category for an agent or its retrieval pipeline operating with over-scoped or inherited credentials relative to the requesting user's own entitlement.
OWASP GenAI Security Project	Top 10 for LLM Applications 2025, `LLM08:2025 Vector and Embedding Weaknesses`	Standard risk category covering retrieval-layer weaknesses this article's target state overlaps with.
Agent State Attack	RAG permission bypass	SSA descriptive framing bundling the ConfusedPilot research and CVE-2026-21836 under one Tool & Environment State entry.

Related terms

Agent state attack: the umbrella definition, including Tool & Environment State among the listed target states.
RAG poisoning: the adjacent Context-surface entry for adversarial content reaching retrieval, contrasted above by what fails, content integrity there, authorization here.
MCP confused deputy and token passthrough: the adjacent Tool & Environment State entry for a different confused-deputy object, an OAuth token's audience, rather than a document's access control list.

FAQ

Is this the same vulnerability as ConfusedPilot?

ConfusedPilot is the Research Term for the specific 2024 demonstration against Microsoft 365 Copilot and the confused-deputy framing it introduced. RAG permission bypass, as used on this site, is the broader SSA descriptive category that ConfusedPilot and CVE-2026-21836 both fall under: a retrieval pipeline serving content a querying user was not entitled to see. Cite "ConfusedPilot" only to the arXiv paper above, not to this site's broader framing.

Does a vendor patch for one CVE mean the broader pattern is fixed?

No. CVE-2026-21836's fix addresses one product's specific enforcement gap. The underlying pattern, an indexing identity's broad access substituting for a per-query authorization check, is an architectural choice available to any RAG pipeline design, and the 2026 systematic review cited above still lists dynamic access control as an open defense area rather than a settled one.

Does entity- or chunk-level filtering fully close this gap?

It closes the specific failure mode where no entitlement metadata exists to check against. It does not by itself guarantee the metadata stays accurate as source-system permissions change, which is why index re-synchronization against revocation events is listed as a separate control above rather than folded into filtering.

Sources

Verification and change history

Standards and versions referenced: OWASP Top 10 for Agentic Applications, Version 2026 (December 2025); OWASP Top 10 for LLM Applications, 2025 edition; CWE-862.

Last verified: 2026-10-20. The ConfusedPilot paper's confused-deputy quotation, worked examples, and version history were read from the arXiv record; the DEF CON AI Village disclosure context and Fortune 500 figure were read from the Cloud Security Alliance repost of Symmetry Systems' own account; the CVE-2026-21836 description, CWE classification, CVSS vector, and publish date were read from the Lutra Security Fieldguide entry and cross-checked against the CVE Program record; the Okta guidance was read from Okta's own published page; the arXiv 2603.21654 access-control reference was read from the paper's own abstract. The OWASP identifiers were read from the official project pages.

Change history: 2026-10-20, first version.

Working-term label: Mixed provenance. "ConfusedPilot" is a Research Term owned by its arXiv authors. CVE-2026-21836 and CWE-862 are Standard Terms owned by the CVE Program and MITRE respectively. ASI03:2026 Identity and Privilege Abuse and LLM08:2025 Vector and Embedding Weaknesses are OWASP Standard Terms. "RAG permission bypass" as the umbrella title for this entry is SSA descriptive wording, not a term attributed to any single source above.