Retest confirms the invoice authorisation flaw is closed
- Affected asset
- GET /api/v2/invoices/{id} on app.example.com.au
- Rating
- Informational Remote 1 × Medium 3 = 3
Description
The high-severity insecure direct object reference from the original web application test has been retested. The endpoint now enforces an ownership check, and an attempt to read another customer's invoice is refused. The finding is confirmed closed and recorded as such in the updated report.
Evidence
GET /api/v2/invoices/1042 HTTP/1.1
Authorization: Bearer eyJhbGciOi... # a customer who does not own 1042
HTTP/1.1 403 Forbidden
{ "error":"not_authorised" }
# previously returned 200 with another customer's invoice
The same request that previously leaked another customer's invoice is now correctly refused.
Impact
The reportable data-exposure risk from the original finding is removed. The updated report and, where offered, an attestation letter give your auditors, customers and insurer evidence that the issue was not only found but fixed and verified.
Remediation
Keep the ownership check in the shared authorisation layer so new endpoints inherit it, add a regression test that asserts the 403 for cross-customer access, and schedule the next test to cover any new endpoints added since.