IDOR object and verb swap
Two accounts. Every verb. Hidden fields and batch IDs are the usual miss.
Tags: idor, bac, api
Techniques
Swap the ID
A's object as B. Path, body, header, GraphQL arg.
GET /api/invoices/ID_FROM_A as user B
Hidden verb
GET is locked, PUT/PATCH/DELETE on the same route is not.
PUT /api/invoices/ID_FROM_ADELETE /api/invoices/ID_FROM_A
Batch / export
Array of IDs, CSV export, search that returns other tenants.
{"ids":["A","B"]}?user_id[]=A&user_id[]=B
Create then retarget
Create as A, change owner/tenant in a second request as A, then fetch as B.
PATCH {"ownerId":"B"} on an object A created