IDOR in Multi-Tenant SaaS Data Models
Shared code exposes one tenant's data when ownership checks skip the data model.
Darnell Whitmore
Section
Access Control
2 stories in Access Control.
Privilege Escalation via Mass Assignment in REST APIs
Attackers can gain admin access by injecting privileged fields into REST API requests.
Mei-Xing Callahan