The analytics interface exposes a dropdown that lists organisation identifiers. Values are used directly in downstream API calls without any server-side validation that the session should have access to them. Low severity on its own because a leaked identifier is not itself sensitive data, but this is the enumeration primitive that removes the "if identifiers are known" caveat from F-01 and F-03. Without F-04 the higher-severity findings still exist; with F-04, they are trivially exploited against every tenant on the platform.
Finding 4 of 5 from the GetConnects multi-tenant API assessment. Delivered , published .
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (isolated). Amplifies F-01 and F-03 to CVSS 9.8 in combination.When the analytics UI loads for a logged-in user, the front-end fetches the list of organisations that populates the tenant-selector dropdown. The list contains identifiers for every tenant on the platform, not just the ones the caller has membership in. The UI hides the entries the user cannot select, but the payload has already been delivered to the client, so an attacker with a browser dev console has the full list.
Enables discovery of valid organisation identifiers for every tenant on the platform. Removes the "if identifiers are known" caveat from the higher-severity BOLA findings. In practice it converts F-01 and F-03 from "exploitable if you happen to know an identifier" to "exploitable against every tenant, one enumeration step".
The finding does not directly expose customer PII on its own, which is why it carries a medium score. Its real cost is combinatorial: in the presence of any BOLA on a handler that trusts a client-supplied organisationId, F-04 upgrades that handler's severity to universal.
organisationId should verify session membership rather than trusting the value.Approximate shape of the list payload received by the client (endpoint identifier redacted):
GET /api/analytics/list-organisations HTTP/2
Host: [REDACTED]
Cookie: token=<low_priv_user>
// Response
{
"json": [
{ "id": "<org_id_1>", "name": "[Tenant 1 redacted]" },
{ "id": "<org_id_2>", "name": "[Tenant 2 redacted]" },
{ "id": "<org_id_3>", "name": "[Tenant 3 redacted]" }
// full platform list follows
]
}Any of the returned id values plugs directly into the request body for F-01, F-02, F-03, or F-05.
| Date | Event |
|---|---|
| Engagement window; finding delivered on . | |
| Following weeks | Remediation and retest cycle. |
| Public release of redacted writeup. |