Two-org tenant replay
Decide which tenant identifier the server trusts by replaying objects you own across two organisations.
Level: intermediate
Tools: Burp Suite, browser devtools
Pipeline
With org A and org B accounts you control, save object ids from {url}, then replay each read as the other org and record which of host, token claim, or body tenant actually selects the row.