Findings
Exploitable issues, each with a traced path from an entry point an attacker can reach to the vulnerable code.
- criticalInvoice PDFs can be downloaded across tenants by changing the id
- highStripe webhook is acted on before its signature is checked
- highAdmin CSV export trusts the orgId in the query string
- highPassword reset links never expire and survive a password change
- mediumMembers can promote themselves by sending role in a profile update
- mediumPost-login redirect follows any absolute URL in ?next=
- mediumReceipt renderer passes the uploaded file name to a shell command
- mediumSession cookie is readable from page scripts (no HttpOnly)
- lowError responses include stack traces outside development
- lowHealth endpoint returns build config, including internal hostnames
10 findings