HIGH · confirmed · LAB-1f0dcbd0e32a6026
Synthetic access policy violated: vulnerable-cross-user
The owner baseline succeeded and the disallowed synthetic request received an unexpected response.
- Location
- app.py:28
- Root cause
- Exact source-level cause is not established by the available evidence.
- Expected
- Actor response status in [401, 403, 404]; protected record inaccessible.
- Observed
- Actor received the configured synthetic resource or disallowed response.
- Remediation
- Enforce the configured ownership/role/input policy at the server-side resource boundary.
- Regression
- Run `appsec-lab verify --finding <id> --authorize` after fixing scenario vulnerable-cross-user; actor must be denied.
- Limitations
- Conclusion depends on the explicitly configured synthetic users, records and expected policy.; Source reference identifies the route declaration/dispatch; it is not a complete execution-path trace.
Evidence and independent verification
{
"evidence": [
{
"test_id": "vulnerable-cross-user",
"category": "authorization",
"method": "GET",
"path": "/records/vulnerable/42",
"timestamp": "2026-10-27T07:30:53.727899+00:00",
"owner": {
"status": 200,
"body_sha256": "2b2acbb0d18af214049cb9b2b0301b5d3e83ee737947054522dc226b17d9a8da",
"body_bytes": 37,
"truncated": false,
"marker_present": true,
"security_headers": {
"content-type": "application/json",
"x-content-type-options": "nosniff"
}
},
"actor": {
"status": 200,
"body_sha256": "2b2acbb0d18af214049cb9b2b0301b5d3e83ee737947054522dc226b17d9a8da",
"body_bytes": 37,
"truncated": false,
"marker_present": true,
"security_headers": {
"content-type": "application/json",
"x-content-type-options": "nosniff"
}
},
"owner_precondition": true,
"expected_status": [
401,
403,
404
],
"violation": true,
"actor_identity": "configured-synthetic-actor",
"duration_seconds": 0.22012025000003632,
"limitations": "Expected policy and fixture ownership are supplied by the developer."
}
],
"verification": [
{
"reviewer": "independent-deterministic-verifier",
"timestamp": "2026-10-27T07:30:54.370712+00:00",
"previous_state": "candidate",
"conclusion": "confirmed",
"new_observation": {
"test_id": "vulnerable-cross-user",
"category": "authorization",
"method": "GET",
"path": "/records/vulnerable/42",
"timestamp": "2026-10-27T07:30:54.588394+00:00",
"owner": {
"status": 200,
"body_sha256": "2b2acbb0d18af214049cb9b2b0301b5d3e83ee737947054522dc226b17d9a8da",
"body_bytes": 37,
"truncated": false,
"marker_present": true,
"security_headers": {
"content-type": "application/json",
"x-content-type-options": "nosniff"
}
},
"actor": {
"status": 200,
"body_sha256": "2b2acbb0d18af214049cb9b2b0301b5d3e83ee737947054522dc226b17d9a8da",
"body_bytes": 37,
"truncated": false,
"marker_present": true,
"security_headers": {
"content-type": "application/json",
"x-content-type-options": "nosniff"
}
},
"owner_precondition": true,
"expected_status": [
401,
403,
404
],
"violation": true,
"actor_identity": "configured-synthetic-actor",
"duration_seconds": 0.21770250000190572,
"limitations": "Expected policy and fixture ownership are supplied by the developer."
}
}
]
}