Failure pattern · 4 documented incidents
Cross-tenant access through a caller-controlled identifier
The server trusts an account, tenant or object ID sent by the client, so changing a number reveals someone else's data.
See it happen
Watch how this failure unfolds, then switch to the same situation with the safeguard in place. Click any step to replay it.
Scroll the diagram sideways to see every system.
Bob’s invoice is returned to Alice.
What goes wrong:
- Alice opens her invoice at /invoices/1041.
- She edits the number in the address bar to 1042.
- The API trusts the ID from the request and never checks who owns it.
- Bob’s invoice is returned to Alice.
With the safeguard:
- Alice opens her invoice at /invoices/1041.
- She edits the number in the address bar to 1042.
- The API scopes every query to the tenant of the signed-in user.
- No match means 404. Guessing IDs reveals nothing.
What it is
The server takes an account, tenant or record ID from the request and believes it. Change one number in the URL or the API call and you’re looking at somebody else’s data.
How it happens
- IDs in URLs or request bodies are sequential or easy to guess
- The server looks up the object without checking who owns it
- Tenant separation relies on the client sending the right ID
What it causes
- One customer reads another customer’s documents or records
- Mass scraping of personal or financial data
- Regulatory penalties and breach notifications
Warning signs
- One account requesting many IDs it has never touched
- Sequential ID enumeration in access logs
- Requests that succeed for objects outside the caller’s tenant
How to prevent it
Derive tenant and object access from the authenticated session. Resolve tenant and ownership from verified session claims, check object-level authorization on every read and write, and back it with row-level security and tenant-namespaced cache keys.
- Every data access is checked against the signed-in user’s identity on the server
- Queries are scoped to the caller’s tenant by default, not by a parameter the client sends
- Tests deliberately try to read another tenant’s objects and must fail
Key ideas:Insecure direct object reference (IDOR)
Check your system against the full launch checklistReal incidents with this pattern
Documented incidents first. Each links to its public source.
Non-secret app ID lets anyone register for private apps built on the Base44 AI app builder (2025)
By supplying only an application's non-secret appid to undocumented registration and email-verification endpoints, an attacker could create a verified account on private applications built with Base44.
Safeguard: Never use an identifier as an authorization check
Default password and an IDOR in McDonald's AI hiring chatbot platform expose data on 64 million applicants (2025)
McHire, the chatbot recruiting platform used by most McDonald's franchisees, lets applicants chat with a bot named Olivia, built by Paradox.ai, that collects personal information.
Safeguard: Remove default and test accounts before production
Privilege escalation and a certificate-validation flaw allow cross-account database access (Azure PostgreSQL "ExtraReplica", 2022)
Researchers exploited a bug in Azure's modified PostgreSQL engine to gain superuser privileges and run operating-system commands on their own database instance.
Safeguard: Validate tenant identity with strict, anchored certificate checks
Missing access checks in a document portal expose over 800 million First American images (2019)
Sequential integer URLs in imaging web portal lacked object-level authorization checks; exposed 885 million escrow and wire documents.
Safeguard: Enforce object-level authorization
183 security advisories and illustrative scenarios with this pattern
Software component issue could allow unauthorized access
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing…
Software component issue could allow unauthorized access
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is…
Software component issue could expose accounts or credentials
A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products.
Software component issue could allow unauthorized access
The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to…
Software component issue could allow unauthorized access
A public security advisory describes this issue. Review the linked source for the technical details and remediation guidance.
Software component issue could allow unauthorized access
The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an…
Security issue reported in Software component
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered…
Software component issue could allow unauthorized access
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid.
Security issue reported in Software component
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API.
Software component issue could allow unauthorized access
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService.
Security issue reported in Software component
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment.
Software component issue could allow unauthorized access
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup.
In the standards
CollectSEA's mapping; not an official determination by the standards bodies.