IDOR — Unauthorized Access to Other Users’ Invoices

Summary#

An IDOR/BOLA vulnerability was identified in the invoice API. An authenticated user could access another user's invoice details by modifying the invoice ID in the API request.

The invoice IDs were predictable/sequential, making it possible to identify valid invoice IDs belonging to other users. The server did not properly verify whether the authenticated user was authorized to access the requested invoice.

Steps to Reproduce#

1. Create two separate accounts: Account A and Account B.
2. Log in to Account A and navigate to Billing → Invoices.
3. Open an invoice belonging to Account A.
4. Intercept the request using Burp Suite:

GET /api/invoices/1111111