Cyber security
research.

Summary

The invoice export endpoint checked that a caller was authenticated, but never checked that they belonged to the account they were exporting. An authenticated user on any tenant could pull another organisation's invoices by changing a single identifier.

Proof of concept

1. Sign in as a low-privilege user belonging to tenant A.
2. Trigger an invoice export and capture the request.
3. Change account_id from A's identifier to tenant B's.
4. Replay. The response returns tenant B's invoices as a PDF.

GET /api/v2/accounts/8f21c4/invoices/export.pdf HTTP/2
Host: app.example.com
Authorization: Bearer <tenant A token>

// swapped to tenant B — no membership check runs
GET /api/v2/accounts/1d90be/invoices/export.pdf HTTP/2
→ 200 OK   application/pdf   412 KB

Impact

Cross-tenant disclosure of billing records: invoice line items, billing contacts, trading addresses and VAT numbers. Because exports are generated on demand, an attacker could enumerate identifiers and pull the full billing history of every organisation on the platform.

No user interaction is required beyond a valid low-privilege session, and nothing in the response indicates the data belongs to someone else - which is what makes it easy to miss in review and hard to spot in logs.