Invoice After Dark

Author

Hamza Hashim

Room overview

A multi-tenant invoicing app uses UUIDs instead of sequential IDs -- but a webhook delivery log leaks another tenant's invoice ID anyway. Chain that leak into a cross-tenant IDOR, pivot from the invoice to a linked payment method, then fix the missing tenant scoping at the data layer.

Hands On Lab: Invoice After Dark

medium · Web · Hands On