FINDING CSO-001High priority
Invoice access is not scoped to the customer.
Observation
A signed-in test user could request an invoice belonging to another test account by changing the invoice identifier.
Evidence
In the fictional reproduction, the response returned the other account’s invoice. The request was authenticated but the resource ownership check was absent.
Business impact
A customer could access invoice information belonging to another customer.
Recommended action
Enforce server-side ownership checks for invoice reads and downloads. Add tests covering permitted and denied access.
Verification
Repeat the original reproduction with two test accounts. Confirm cross-account requests are denied and authorised access continues to work.