IDOR in Business User CRM Contact Endpoint Exposes Other Users’ Internal Contact IDs
A business-management mobile API endpoint returned the internal CRM Contact ID associated with a supplied business-user identifier without verifying that the authenticated caller owned, or was authorized to access, that business-user object.
Vulnerability: Insecure Direct Object Reference / Broken Object Level Authorization (CWE-639) · Severity: Medium (CVSS 5.0) — authenticated cross-user access exposed internal CRM Contact IDs; impact was limited because the endpoint required authentication and did not directly return PII, but the identifiers could be harvested at scale if business-user IDs were collected.
Summary
A business-management mobile API endpoint returned the internal CRM Contact ID associated with a supplied business-user identifier without verifying that the authenticated caller owned, or was authorized to access, that business-user object.
The vulnerable endpoint was:
GET https://[REDACTED-HOST]/business_user/{business_user_id}/crm_contact_id/v1