Findings
7 open across 3 applications. Fixed findings are retested on every run.
SeverityFindingStatus
- HighBOLA on GET /api/invoices/:idARG-142 · 7be21f0 · 5h agoIn progress
- MediumCSP allows unsafe-inline on /docsARG-117 · e72b114 · 12d agoOpen
- MediumSession cookie lacks Secure on /legacyARG-131 · 0c5d8a3 · 9d agoOpen
- MediumMissing rate limit on POST /auth/resetARG-124 · 9ad41fe · 11d agoOpen
- MediumCORS allows any origin on /v2/publicARG-120 · 9ad41fe · 12d agoOpen
- LowVerbose error on /graphql parse failureARG-098 · e72b114 · 19d agoOpen
- LowCookie "theme" missing SameSiteARG-139 · a1c94e2 · 2h agoOpen
ARG-142 · Introduced in 7be21f0In progress
BOLA on GET /api/invoices/:id
OWASP API1:2023CWE-639Confidence: confirmedAuth: member role
The invoice lookup does not check which tenant owns the invoice. Any signed-in user can read another tenant’s invoice by changing the id in the URL.
Evidence · replay
GET /api/invoices/inv_7Q2K (as ana@acme.dev, tenant acme)
→ 200 {"id":"inv_7Q2K","tenant":"acme","total":1240}
GET /api/invoices/inv_91XD (same session, invoice of tenant globex)
→ 200 {"id":"inv_91XD","tenant":"globex","total":8800}
expected 404, got another tenant’s record
Suggested fix · routes/invoices.ts
- const inv = await db.invoices.find(req.params.id);
+ const inv = await db.invoices.find(req.params.id, req.user.tenantId);
if (!inv) return res.sendStatus(404);