Authorization / IDOR
If you only have one account you are guessing. Two accounts is the test.
Tags: idor, bac, ato
Checklist
- Two users, one tenant: User A object IDs replayed as User B. Every verb.
- Two tenants: Same as above across organisations. Tenant ID in JWT vs in the path vs in the body.
- Vertical: User hits admin routes, admin fields, admin GraphQL mutations, admin exports.
- Hidden verbs: GET works, PUT/PATCH/DELETE on the same object does not check authz.
- Batch / export / search: Array of IDs, CSV export, global search, async jobs, webhooks of other users' events.
- Create then swap: Create as A, change the owner/tenant field, or access as B by ID.
- WebSocket / GraphQL subscriptions: Subscribe to another user's channel or node(id:).
- Unsigned IDs: Base64, hashids, UUIDs leaked elsewhere, sequential invoices, filenames.