CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to manipulate a company ID parameter in POST requests, leading to unauthorized access to data belonging to other companies within the same subdomain. This cross-tenant authorization bypass can result in exposure of sensitive customer information, including billing data, and potential unauthorized modifications to third-party data. Organizations utilizing this application should prioritize remediation to protect customer data and maintain compliance with data protection regulations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.