ClickHouse (Bugcrowd cash $2.5k, in-scope) scout-candidate: getFunctionURINormalized() (src/TableFunctions/ITableFunction.cpp:95) returns "" when Poco::URI() throws, and that empty string is the FILTER arg to checkAccessWithFilter(...) for a per-URL source grant. Thesis: a user CONFINED to one host via GRANT URL ON 'https://allowed/' escapes the confinement because the filter collapses to empty. Scout honestly flagged the bypass DIRECTION (granted vs denied) as runtime-unconfirmed.
The premise feature DOES NOT EXIST. On ClickHouse 26.5.1: GRANT URL ON 'http://x/' and GRANT URL('http://x/') both throw Code 62 SYNTAX_ERROR. The URL source privilege is GLOBAL (GRANT URL ON *.* = on/off), there is NO per-URL/per-host scoped grant. Host confinement is the remote_url_allow_hosts SERVER CONFIG, enforced on the FETCH side (RemoteHostFilter / withHostFilter) - which the scout itself noted does NOT collapse to empty. So the empty-filter has no per-URL scope to bypass; the real host guard is untouched. NON-FINDING.
Before drilling a parser-/normalization-DIFFERENTIAL authz bypass (the "two views of the same value diverge" class), VERIFY THE PRECONDITION FEATURE EXISTS first - the most disposable, cheapest check. A differential is only a vuln if there is a REAL confinement on one side to escape. Here the "confinement" (per-URL grant) was a misread of a checkAccessWithFilter doc-comment; the feature is global, so there was nothing to bypass. One GRANT ... against a live instance (seconds) killed a lead that otherwise invites a multi-hour source/build drill.
- Gate ordering: PRECONDITION-EXISTS (does the grant/role/scope the bypass escapes actually exist as a feature?) -> sits BEFORE the expensive reachability/direction runtime drill, right after disclosure+cash.
- Tell: a candidate whose impact sentence is "escape the SCOPE of grant X" - immediately ask "is grant X a real, per-resource-scoped feature, or a global on/off?" If global, a value-differential in the filter arg bypasses nothing.
Related: [[feedback_cross_fork_portlag_primitive]] (false-positive guard = verify the deeper computation), [[2026-06-21-cycle274-agent-tool-unsandboxed-code-interpreter-and-osv-lane-ev]] (re-verify scout claims firsthand).