Cross-tenant authorization bypass
A low-privilege user can access records belonging to another organization by changing a predictable object identifier.
Confidential customer records can be exposed across tenant boundaries without administrative access.
GET /api/v2/invoices/8421 Authorization: Bearer user_token HTTP/1.1 200 OK tenant_id: another-organization
Cross-tenant data access may expose regulated records, breach customer isolation commitments and trigger notification obligations.
- Resolve the tenant from the authenticated session.
- Apply object-level authorization before every read and update.
- Add negative cross-tenant tests to the release pipeline.