One company's users can see another company's data
Cross-tenant data exposure
What this means
Your app serves several companies or workspaces, but database queries are not limited to the user's own workspace. Guess an identifier and a neighbouring company's data opens up.
Why it matters
A leak between customers is the worst kind of incident for a service: it damages your standing with every other customer at once, and it usually breaches your data processing agreement.
How to fix it
- Include workspace ownership in every data query.
- Take the workspace from the server-side session, never from a client-supplied parameter.
Prompt for your AI agent
Scope every data query to the current user's workspace. Read the workspace identifier from the server session, not from the request.
How to verify the fix: request another workspace's data — expect a refusal
References: cwe.mitre.org