F-01High severitySample report, fictional data
Access to another customer’s orders through the API
7.1 CVSS 3.1
- Component
- GET /api/orders/{id}
- What we found
- A logged-in user can read another user’s order by changing the order number in the URL.
- Business impact
- Exposure of customer names, addresses and order details.
- Classification
- CWE-639
Steps to reproduce
- Log in as test customer A and open one of their orders. The request is GET /api/orders/10482.
- Log in as test customer B in a separate browser session.
- With customer B’s token, send the same request for order 10482.
- The server returns 200 with customer A’s name, address and items. The expected response is 404.
Request and response (sensitive values redacted)
GET /api/orders/10482 HTTP/1.1Host: api.shop.exampleAuthorization: Bearer [customer B token] HTTP/1.1 200 OKContent-Type: application/json {"id":10482,"customer":"[redacted]","address":"[redacted]","items":[…]}How to fix
- In the order handler, look the order up by both its ID and the logged-in user’s ID, for example WHERE id = ? AND customer_id = ?.
- If no order matches, return 404, the same response as for an order that does not exist.
- Apply the same check to every endpoint that takes an order ID.
- Add an automated test that logs in as one user, requests another user’s order and expects 404.