- Analyzer
- dast
- Category
- Object authorization
- Default severity
- Not encoded
- CWE
- Not encoded
- Execution
- Two-user
- Authentication
- Two identities
- Applicability
- url
- Availability
- stable
What it detects
Object access that appears to cross user boundaries when two authorized identities are supplied.
Evidence
Responses for the same object request under two distinct authenticated identities.
Remediation
Authorize every object access against the current principal and tenant boundary.
Limitations
This check is limited to the applicability and evidence delivered by dast. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Remediation guidance: Remediation and fix verification · Baselines and suppressions