Title
Post-auth BOLA via Supabase RLS policy gap across tenants
Target
?
Class
IDOR | asset: kurs.onecode.de (/api,/v1 + Supabase /rest via app) | confidence: 62
Confidence
0/100
Reasoning
Backend confirmed as single Supabase project (multi-user invite-only course platform). Authenticated-user table access is governed by RLS; a missing user_id/token filter in a SELECT policy yields cross-tenant reads of courses/enrollments/resources. UUID PKs weaken pure-ID enumeration → RLS-policy-gap is the realistic high-value target.
Evidence needed
response delta when authenticated account A requests an object owned by account B (via app routes or the app's Supabase client).
Verify steps
(post-auth) two invited accounts; A GET /api/courses/{B_id}, /api/resources/{B_id}, /api/enrollments/{B_id} comparing 200-with-data vs 404/403; compare authenticated Supabase query results across accounts.
Impact
cross-tenant course resource + PII disclosure (High) | testability: AUTH_HELPED
Testability
model: bigpickle · auto-synced from leads/lead-*.md
Title
Post-auth BOLA via Supabase RLS policy gap across tenants
Target
?Class
IDOR | asset: kurs.onecode.de (/api,/v1 + Supabase /rest via app) | confidence: 62
Confidence
0/100
Reasoning
Backend confirmed as single Supabase project (multi-user invite-only course platform). Authenticated-user table access is governed by RLS; a missing
user_id/token filter in a SELECT policy yields cross-tenant reads of courses/enrollments/resources. UUID PKs weaken pure-ID enumeration → RLS-policy-gap is the realistic high-value target.Evidence needed
response delta when authenticated account A requests an object owned by account B (via app routes or the app's Supabase client).
Verify steps
(post-auth) two invited accounts; A GET
/api/courses/{B_id},/api/resources/{B_id},/api/enrollments/{B_id}comparing 200-with-data vs 404/403; compare authenticated Supabase query results across accounts.Impact
cross-tenant course resource + PII disclosure (High) | testability: AUTH_HELPED
Testability
model: bigpickle · auto-synced from leads/lead-*.md