Just a moment...
Imrane T. — Offensive Security | Attack Chains & Business Logic
Found a GraphQL API where small issues chained into full cross-tenant compromise.
Leaked workspace ID (client-side)
Unauth mutations (invite / waitlist)
No rate limit + batching abuse
IDOR on workspaceId (read + write)
Impact: API keys, secrets, payments + full tenant takeover
Write-up: https://medium.com/@insid_e/from-graphql-enumeration-to-cross-workspace-takeover-8e5a63edfcd0
1 reactions · 0 comments