Case study - Two critical cross-customer bugs in a B2B SaaS
A B2B platform used by 340 business customers, tested with partial access (grey box).
- System
- Multi-tenant B2B SaaS, 340 business customers
- When
- Previous engagement
- Service
- Grey-box penetration test
Overview
A multi-tenant B2B platform with 340 business customers. We tested with partial access (grey box): test accounts in two tenants and read access to the API documentation.
What we did
We built an authorization matrix of 141 checks across 47 endpoints and replayed every request with another customer's identifiers.
What we found
Nine checks failed, giving 13 findings. Two were critical: another customer's invoices could be read directly, and a profile update could raise a user's own role.
Result
Both critical findings were fixed within five days and the retest passed.
What it touched
- Tenant isolation
- IDOR
- Role escalation
- Retest
- Authorization checks
- 141
- Findings
- 13
- To fix both criticals
- 5 days