Illustrative scenarioDate not recordedIllustrative scenario

Cross-Tenant Redis Session Hijacking via Unprefixed Cache Keys

Session store used un-namespaced integer user IDs; tenant A authenticated as user 101 retrieved session of tenant B user 101.

Illustrative scenario, not a real incident

A composite failure pattern written by CollectSEA for learning and demos. It is NOT a documented real-world incident and has no primary source.

What happened

    Contributing factors stated by the source

    • Session store used un-namespaced integer user IDs; tenant A authenticated as user 101 retr...

    The failure pattern

    Cross-tenant access through a caller-controlled identifierThe server trusts an account, tenant or object ID sent by the client, so changing a number reveals someone else's data.How to prevent it Automation acts on stale state or authorizationA background job or automation acts on a plan, permission or record that changed after it was read.How to prevent it
    Watch the pattern: Cross-tenant access through a caller-controlled identifier

    Related standards

    CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

    Building something similar?

    Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

    Analyze your design

    Incidents with the same pattern

    Security advisory2026-10-16

    Software component issue could allow unauthorized access

    ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing…

    Cross-tenant access through a caller-controlled identifiernvd.nist.gov
    Security advisory2026-10-16

    Software component issue could allow unauthorized access

    The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is…

    Cross-tenant access through a caller-controlled identifiernvd.nist.gov