AP-0104Identity & accessSeverity · High

Object ownership missing on a generated endpoint

An endpoint accepts an object identifier from the client and returns or mutates the object without confirming the caller owns it. Common in handlers written by coding assistants, which reproduce the shape of neighbouring code but not its authorisation.

How MATT tests it

  1. 01Enumerate every endpoint that accepts an ID (path, query, body, header).
  2. 02Request each with a second account's ID and compare responses.
  3. 03Chain successful reads into writes: update, export, delete.
  4. 04Repeat after every release; new handlers are the usual source.

A real instance

GET /api/orders/{id} returned another customer's order with full address and last-four card digits. Handler generated three days earlier; review approved; tests passed.

Details altered to protect the customer. Pattern, timing and outcome are as found.

What this means for ExploitOps

A check that was never written is found by proving the deployed behaviour, fixed with the engineer who shipped it, and kept fixed by running the control on every change. What is ExploitOps? →

Understand your own attack surface → Book an ExploitOps Review
ExploitOps Review

Understand your own attack surface.

Sixty minutes with a security researcher. Where your product breaks, where your current model breaks, and what continuous adversarial testing should look like. Paid; settled when you book.

Book an ExploitOps Review→