Authorization / IDOR
If you only have one account you are guessing. Two accounts is the test.
Tags: idor, bac, ato
Checklist
- Two users, one tenant — User A object IDs replayed as User B. Every verb.
- Two tenants — Same as above across organisations. Tenant ID in JWT vs in the path vs in the body.
- Vertical — User hits admin routes, admin fields, admin GraphQL mutations, admin exports.
- Hidden verbs — GET works, PUT/PATCH/DELETE on the same object does not check authz.
- Batch / export / search — Array of IDs, CSV export, global search, async jobs, webhooks of other users' events.
- Create then swap — Create as A, change the owner/tenant field, or access as B by ID.
- WebSocket / GraphQL subscriptions — Subscribe to another user's channel or node(id:).
- Unsigned IDs — Base64, hashids, UUIDs leaked elsewhere, sequential invoices, filenames.