Tenant isolation
A tenant is the boundary between organizations, not a label in the UI. The test is two organizations you are allowed to join, and which identifier the server actually trusts.
Tags: tenant, idor, authz, saas
Level: intermediate
Method
Create two orgs you own
Org A and org B, with separate users. Do not use a customer tenant as the other side.
Tools: browser
Name where the tenant is chosen
Path, host, token claim, header, and body can each name an org. Change one at a time and write down which one changes the rows you see.
Tools: Burp Suite
Replay an object you own
Take an object id from org A and request it with org B's session. Status, body, and whether a write lands are the result.
Tools: Burp Suite, Caido
Host versus token
When the host says org A and the token says org B, record which side wins for read and which side wins for write.
Tools: Burp Suite
Jobs, files, and search
Exports, audit logs, notification lists, and background jobs often skip the filter the UI uses. A job created in A should not be readable from B.
Tools: Burp Suite
Stale membership
Leave org A and keep the old tab. Note whether the previous token still authorizes.
Tools: browser
Field notes
- A user who can read a teammate is a different bug from a user who can read another organization. Name the boundary you crossed.
- UUIDs still count when they leak through exports, invites, or object paths.
- Guest and external collaborator roles are a third boundary. Test them if the product has them.