vulns.co
/
GKData.io MCP

Back to Gadgets

Tenant id trusted by an export

Exports, scheduled reports, and download-all jobs often take a tenant id, org id, or workspace id in the request, the job row, or the object path. The UI checked membership when the button was clicked. The worker that builds the file sometimes does not.

Tags: tenant, export, authz, bola

Typical severity: P2-P4

What it becomes

Low alone when the worker re-checks membership, and it becomes a cross-tenant data leak when the export trusts a client-supplied tenant id.

Where to look

  • CSV, PDF, and warehouse exports
  • async report workers
  • download-all jobs that take an organization id

Chains

  • Cross-tenant read: Two tenants you belong to, and the export for one returns rows from the other because the worker trusted the supplied tenant id.
  • Shared artifact: The file is stored or mailed under a path or link that does not re-check the tenant, so the cross-tenant result outlives the API call.

Notes

  • Use two tenants you are allowed to join. Do not request another customer's organization.
  • A UUID is not a membership check. If you learned the id from your own invite or from a file you already received, say where it came from.