vulns.co
/
GKData.io MCP

Back to Checklists

Tenant isolation

A tenant is a boundary, not a label in the UI. Replay objects you own across two organisations and record which identifier the server actually trusts.

Tags: tenant, idor, bac, saas

Checklist

  • Two orgs you own: Create org A and org B with separate users. Do not use a customer tenant as the other side.
  • Where the tenant is named: Path, host, subdomain, token claim, header, and body can each name an org. Write down which one changes the rows you see.
  • Object replay: Take an object id from org A and request it with org B's session. Status, body, and whether a write lands are the result.
  • Host versus token: When the host says org A and the token says org B, record which side wins for read and which side wins for write.
  • Membership changes: Accept an invite, leave an org, and keep a stale tab. Note whether the old org cookie or token still authorizes.
  • Role inside the org: Owner, member, and guest or external collaborator. Shared links should not grant the same writes as membership.
  • Search, export, audit: Global search, CSV export, audit log, and notification lists. These often skip the tenant filter the UI applies.
  • Jobs and files: A job or file created in org A should not be readable, cancelable, or downloadable from org B by id.