Not every finding is clever. This one took four minutes, and it is worth publishing precisely because it still exists in 2026 on a product that bills real companies.
The whole thing
GET /billing/invoices/80422/pdf HTTP/2Host: app.target.tldCookie: session=████████████████Decrement by one:
HTTP/2 200 OKcontent-type: application/pdfcontent-disposition: inline; filename="INV-80421.pdf"A PDF belonging to a different company, with its legal name, billing address, contact email and line items. No 403, no ownership check, no rate limit. I read three invoices to establish the pattern, confirmed they were not mine, and stopped.
Why it survived
The invoice route was added before the platform grew an authorisation layer, and it sits in an older router that the newer middleware never got mounted on. Nothing in the code looks wrong when you read that file on its own, which is exactly why reading a single file is not a review.
Takeaways
- Try the boring thing first. Sequential identifiers in a URL are still the fastest finding in the book.
- Authorisation middleware applied per router is authorisation you will forget to mount. Default to deny at the framework level.
- Stop at three. You only need enough to prove the pattern, and every extra record is someone’s real data.
Disclosure timeline
- Report sent
- Triaged
- Fix deployed
- Cleared for publication