Find vulnerabilities before attackers do.

AFFECTED CODE — src/routes/invoices.ts

// invoices are fetched by id for any authenticated session
router.get('/invoices/:invoiceId', requireAuth, async (req, res) => {
  const invoice = await db.invoices.findById(req.params.invoiceId)
  if (!invoice) return res.status(404).json({ error: 'not_found' })
  return res.json(invoice)  // returned without ownership validation
})

The route authenticates the caller but never verifies that the invoice belongs to the caller’s account.

SAFE REPRODUCTION — AUTHORIZED STAGING ENVIRONMENT

$ curl -i https://api.acme.example/invoices/8412 -H "authorization: Bearer $ACCOUNT_A_TOKEN"
HTTP/2 200 — invoice 8412 · account A

$ curl -i https://api.acme.example/invoices/8412 -H "authorization: Bearer $ACCOUNT_B_TOKEN"
HTTP/2 200 — invoice 8412 · account B  ⚠ cross-account read

OBSERVED PATH

Each hop was confirmed against the API inventory and repository analysis before this finding was verified.

RECOMMENDED REMEDIATION

Scope the invoice query to the authenticated account at the data layer, so ownership is enforced on every read rather than in scattered route checks.

  const invoice = await db.invoices.findOne({
    id: req.params.invoiceId,
+   accountId: req.user.accountId,  // scope every query to the caller’s tenant
  })
  if (!invoice) return res.status(404).json({ error: 'not_found' })

Return 404 rather than 403 so the API does not confirm that another tenant’s resource exists. Apply the same pattern to the seven sibling routes flagged in this repository.

1. 09:41 UTC
   Detected — Veyra Code flagged missing ownership validation on a changed route.
2. 09:43 UTC
   Correlated — route matched to a public endpoint and the billing datastore.
3. 10:12 UTC
   Verified — reproduced safely in the customer-authorized staging environment.
4. 10:15 UTC
   Alerted — engineering notified. Status: open, awaiting assignment.