Anyone can change someone else's data
Broken Object Level Authorization on write
What this means
Your app checks who is signed in before saving a change, but not whether the record being changed belongs to them. Anyone with an account can edit another customer's order, document or profile by sending the record number.
Why it matters
Reading someone else's data is a leak; changing it is a forgery you cannot detect afterwards. The edit arrives from a valid account and looks like ordinary use, so nothing in your logs marks it as suspicious — and the customer whose record changed has no reason to suspect anything either. Prices, delivery addresses and payment details are the usual targets.
When this is not a problem
Shared records that any team member is meant to edit — a common workspace document, a shared task board — are not a finding.
How to fix it
- Check ownership on every write, not only on read — they are separate handlers and the check is easy to forget in one of them.
- Load the record scoped to the current user, then update it; do not load by identifier alone.
- Where the database enforces row-level rules, state the condition for writes as well as reads.
Add a server-side ownership check to every update and delete handler, not just the read ones. Load the record scoped to the signed-in user and return 403 when it belongs to somebody else.
How to verify the fix: sign in as a second account and change the first account's record — expect a refusal