Home / Knowledge hub / Cross-account access
Knowledge hub
Cross-account access
One signed-in account reaching another account's data or functions.
What it means
Cross-account access is when one signed-in account can reach data or functions that belong to a different account. A customer reads another customer's invoices, a member edits someone else's profile, or an ordinary account opens an admin tool. The person is authenticated, but not authorised for that thing.
It covers two directions. Sideways, between accounts of the same level, is horizontal escalation. Upwards, from an ordinary account to staff-only functions, is vertical escalation. Both come from the same gap: the app checks who you are but not what you may touch.
Why it matters
It is the flaw behind many of the worst breaches in business software, because the damage is other customers' data. OWASP puts broken access control first in its Top 10 for 2021. One missing check can expose every record in the table, and each customer's contract probably says you will not let that happen.
Scanners find it badly, because a request that works for one account looks the same as a legitimate one. Only a test that uses two accounts and compares what each can reach shows the difference. That makes it a job for a person or a logic-aware tester, not a signature.
How it shows up
You meet it in APIs that take an id from the request, in export and download links, in search, in admin features reachable by URL, and in background jobs that run without the user's context. New features are risky: the first version checks, and the quick extension does not.
To test it, make two ordinary accounts and one privileged one, then replay each account's requests with the other's identifiers and session. Compare what comes back. The fix is a check on the server, for every request, that ties the record to the account. Hiding the link in the interface does not count.
Questions people ask
Cross-account access, answered
Is cross-account access the same as IDOR?
IDOR and BOLA are common causes of it. The term cross-account access describes the outcome, one account reaching another's data, whatever the technical cause.
Can a scanner find it?
Usually not well. A scanner has one session, so it cannot tell that a response belongs to someone else. Finding it takes at least two accounts and a way to compare.
Does using UUIDs instead of numbers fix it?
No. Hard-to-guess ids make guessing harder, but an id that leaks in a link, email or log still works. The server must check ownership.
Does it apply to B2B apps with organisations?
Yes, and more so. The unit is the organisation or tenant. Members of one organisation reaching another's records is a tenant data leak.
How do we test for it?
Use separate accounts at each level, capture their requests, and swap ids, tokens and paths between them. Any response that shows data the account should not see is a finding.
Sources
Where this comes from
Related
Terms that sit next to this one
Broken access control
An application failing to enforce its own rules about who may do what.
BOLA
An API returns a record just because you asked for it by number.
IDOR
Changing an id in a request and getting back someone else's record.
Horizontal privilege escalation
Reaching another user's data at your own level, not a higher one.
Tenant data leak
One customer seeing records that belong to another customer of your service.
What can one account reach of another's?
We check what each signed-in account can reach that it should not, and prove it with the request, the response and, in white-box mode, the line of code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.