A software company asked ioSENTRIX to test its multi-tenant web platform and the APIs behind it. In a short, focused engagement, we found more than ten issues.
Our testers held accounts at several permission levels, then replayed each API call under every role and against other customers’ records to compare what each was allowed to see.
Beyond the signature findings: settings and schedules exposed to restricted roles, an internal ID leak that enabled the credential chain, a missing function-level check, no rate limit on search, and weak input validation.
A read-only role reached stored secrets, and tenant isolation failed too. Both are now fixed and retested.
The record endpoint checked that a user was signed in, but not which organisation the record belonged to. Record IDs were sequential and the endpoint had no rate limit, so every customer’s records could be collected by a simple script.
Business impact. One customer could read another customer’s confidential business data, breaking the platform’s core promise of isolation.
Access was checked on parent objects but not on their sub-resources. A user with the platform’s lowest, read-only role could request authentication settings directly and receive HTTP Basic credentials and OAuth client secrets in plain text. Webhook secrets and one-time-password seeds leaked the same way.
Business impact. Stolen credentials would let an attacker act as a customer’s own service accounts on the systems those credentials unlock.
The worst let any signed-in user read other customers’ records by changing one number. A second let a read-only role pull stored integration credentials. The client closed every finding, and ioSENTRIX retested the fixes.
10+ findings in total, including 1 Critical and 4 High.
✓ Verification: All closed by the client; retested by ioSENTRIX.
The interface hid the secrets. The API handed them over.
Being signed in is not permission to see a record (OWASP API1).
A role allowed to see a profile is not allowed to see its secrets.
If the API returns a value, the user has it, whatever the interface shows.
Details in this case study are anonymised and generalised. Methods that could harm other products are withheld.
A software company asked ioSENTRIX to test its multi-tenant web platform and the APIs behind it. In a short, focused engagement, we found more than ten issues.
Changing one number opened another customer’s records. One customer could read another customer’s confidential business data, breaking the platform’s core promise of isolation.
10+ findings in total, including 1 Critical and 4 High.
All closed by the client; retested by ioSENTRIX.
Web application and API penetration testing, delivered by the ioSENTRIX application security testers.
