Loading...
Loading...
API endpoint exposes internal object IDs without access control.
1app.get('/api/invoice/:id', async (req, res) => {2 const invoice = await Invoice.findById(req.params.id);3 res.json(invoice);4});
The API returns any invoice by ID without checking if the requesting user should have access. Attackers can enumerate invoice IDs to access confidential business data.
Attacker iterates through invoice IDs to steal business data
GET /api/invoice/INV-0001
GET /api/invoice/INV-0002
GET /api/invoice/INV-0003✓ Access to all invoices in system
✓ Competitor pricing exposed
✓ Customer lists leaked