Home·Features·Cross-user replay example
Cross-user replay example
Cross-user / IDOR · Demo shop·Routelint·
User A’s captured invoice URL is sent again with User B’s token. The body still belongs to User A, so the route is treating the caller as optional.
- Route
- GET /api/invoices/inv-9001
- Identity
- User B, peer of User A
- Status
- 200
- Severity
- CRITICAL
{ "id": "inv-9001", "ownerId": "user-aaa-111", "amount": 4200, "card": "[REDACTED_CARD]" }Any signed-in caller on the demo shop can read any invoice id. The card number is stored as [REDACTED_CARD].