A variable shadowing bug in Linear skipped a permission filter, exposing private team data

On Tuesday March 24, 2026, Linear deployed a code change that exposed data from private teams to other members within the same workspace. For about an hour, from 12:07 to 1:10 AM UTC, workspace members including guest users could access data outside their normal team permissions.

Linear's authorization layer uses 'sync group' resolvers to add permission filters per query. A performance optimization was designed to skip resolvers that could never match a user, and was gated to run only in a single internal workspace. But the code path that disabled the optimization elsewhere had a variable shadowing bug: instead of falling back to the original filters, it dropped all user-specific resolvers, so the downstream permission check was skipped entirely and queries silently returned unfiltered results.

The change had been peer-reviewed and tested, but only the optimization-active path was covered; nobody tested the disabled-for-other-workspaces path. Linear's team specifically noted the bug was not AI-written — it was a human variable shadowing regression that caught a test-coverage gap.

Exposure flowed through notification digests (one member could get a digest for the whole workspace), client sync bootstraps, mobile sessions, and broad OAuth/API queries. No credentials or API keys leaked, and there was no evidence of malicious abuse. Linear reverted the change within an hour, force-reloaded web and desktop clients, logged out active mobile sessions, and notified affected workspace contacts within 48 hours.

For ~1 hour on March 24 2026, private-team data was accessible to other members and guests in the same workspace; ~7,000 syncs and API calls may have pulled it.

The optimization's disabled path had a variable shadowing bug that omitted all user-specific resolvers.

Test coverage validated the optimization when active but not the path where it was turned off.

Permission checks failed open: the query returned results instead of raising an error.

Notification, sync, mobile and API layers all trusted the broken permissions layer.

An access-control 'optimization' that skips a filter is only safe if its disabled path is tested, or a happy-path review green-lights a silent permission widening.

Linear expanded integration tests across deployment environments, team types, roles, guest access and auth methods, capped notification items per digest, and committed to tighter pre-deployment security reviews and monitoring for authorization anomalies. It notified owners of affected workspaces, and for those requesting it, provided per-workspace exposure summaries. Users wrote it up as a rare, transparently-handled security incident by a company that had just crossed $100M ARR.