vulns.co
/
GKData.io MCP

Back to Playbooks

Tenant isolation

A tenant is the boundary between organizations, not a label in the UI. The test is two organizations you are allowed to join, and which identifier the server actually trusts.

Tags: tenant, idor, authz, saas

Level: intermediate

Method

  1. Create two orgs you own

    Org A and org B, with separate users. Do not use a customer tenant as the other side.

    Tools: browser

  2. Name where the tenant is chosen

    Path, host, token claim, header, and body can each name an org. Change one at a time and write down which one changes the rows you see.

    Tools: Burp Suite

  3. Replay an object you own

    Take an object id from org A and request it with org B's session. Status, body, and whether a write lands are the result.

    Tools: Burp Suite, Caido

  4. Host versus token

    When the host says org A and the token says org B, record which side wins for read and which side wins for write.

    Tools: Burp Suite

  5. Jobs, files, and search

    Exports, audit logs, notification lists, and background jobs often skip the filter the UI uses. A job created in A should not be readable from B.

    Tools: Burp Suite

  6. Stale membership

    Leave org A and keep the old tab. Note whether the previous token still authorizes.

    Tools: browser

Field notes

  • A user who can read a teammate is a different bug from a user who can read another organization. Name the boundary you crossed.
  • UUIDs still count when they leak through exports, invites, or object paths.
  • Guest and external collaborator roles are a third boundary. Test them if the product has them.

References