Illustrative example — not a client assessment or an executed lab test. All systems, records, evidence, and outcomes below are fictional. This example demonstrates report structure; it does not establish a vulnerability in any live product.
Executive summary
A fictional two-tenant document portal illustrates how a missing authorization check could let one authenticated customer retrieve another customer's document. The recommended priority is to enforce ownership checks on every document request and verify isolation with regression tests.
Scope and limitations
- Example environment: portal.example.test; synthetic customer organizations Alpha and Beta.
- Example roles: one ordinary user in each organization, with one synthetic document each.
- Illustrated coverage: reading a document by identifier. Uploads, administrator access, infrastructure, and other endpoints are outside this example.
- No actual testing was conducted to produce this illustrative report.
Finding WEB-01: Missing document ownership check
Illustrative severity: High. This assumes an ordinary authenticated account can read sensitive documents belonging to another customer without additional approval. Actual severity depends on data sensitivity, reachability, prerequisites, and the extent of exposure.
Expected behavior
Alpha's user can retrieve Alpha's document. Requests for Beta's document should be denied without returning its contents.
Illustrative evidence
| Scenario | Expected | Hypothetical vulnerable result |
|---|---|---|
| Alpha reads Alpha document | 200; Alpha content | 200; Alpha content |
| Alpha requests Beta document | 403 or non-disclosing 404 | 200; Beta content |
| Unauthenticated request | 401 or equivalent denial | 401; denied |
Validation procedure for an authorized test environment
- Create two synthetic organizations, separate test users, and distinct test documents.
- Confirm each user can retrieve their own document.
- Using Alpha's session, request the known Beta test document identifier.
- Record the status and whether any Beta content is returned. Keep evidence limited to synthetic data.
- Repeat after remediation and check adjacent document operations included in scope.
Remediation
Resolve the caller's identity and organization on the server, then authorize access to the requested document before returning content. Apply equivalent checks to download, preview, export, and modification paths. Unpredictable identifiers alone do not provide authorization.
Retest status
Not performed. This fictional example includes no claim of a completed fix. A real retest should record the build, date, scenarios, results, and remaining limitations.
Remediation handoff
In an engagement, assign an owner and target date to each finding. A status such as open, partially remediated, or verified fixed should be supported by evidence and the agreed retest scope.
Methodology references
The OWASP Web Security Testing Guide provides application testing guidance. NIST SP 800-115 discusses planning, conducting, and reporting technical security assessments. These references do not constitute certification or endorsement of Steelcrest.
Prepared by Steelcrest Investigations LLC · October 26, 2026. To save a copy, use your browser's Print → Save as PDF.