HIGH · confirmed · LAB-f83eded2773d4eb4
Synthetic access policy violated: vulnerable-cross-user
The owner baseline succeeded and the disallowed synthetic request received an unexpected response.
- Location
- /records/vulnerable/42
- Root cause
- Exact source-level cause is not established by the available evidence.
- Expected
- Actor response status in [401, 403, 404]; protected record inaccessible.
- Observed
- Actor received the configured synthetic resource or disallowed response.
- Remediation
- Enforce the configured ownership/role/input policy at the server-side resource boundary.
- Regression
- Run `appsec-lab verify --finding <id> --authorize` after fixing scenario vulnerable-cross-user; actor must be denied.
- Limitations
- Conclusion depends on the explicitly configured synthetic users, records and expected policy.
Evidence and independent verification
{
"evidence": [
{
"test_id": "vulnerable-cross-user",
"category": "authorization",
"method": "GET",
"path": "/records/vulnerable/42",
"timestamp": "2026-10-27T12:24:30.702891+00:00",
"owner": {
"status": 200,
"body_sha256": "25b562d9bec6c7296370d66bb2a739bce7a06e7a2dbee859aababaece81f5468",
"body_bytes": 55,
"truncated": false,
"marker_present": true,
"security_headers": {
"content-type": "application/json"
}
},
"actor": {
"status": 200,
"body_sha256": "25b562d9bec6c7296370d66bb2a739bce7a06e7a2dbee859aababaece81f5468",
"body_bytes": 55,
"truncated": false,
"marker_present": true,
"security_headers": {
"content-type": "application/json"
}
},
"owner_precondition": true,
"expected_status": [
401,
403,
404
],
"violation": true,
"actor_identity": "configured-synthetic-actor",
"duration_seconds": 0.21063562499330146,
"limitations": "Expected policy and fixture ownership are supplied by the developer."
}
],
"verification": [
{
"reviewer": "independent-deterministic-verifier",
"timestamp": "2026-10-27T12:24:30.906403+00:00",
"previous_state": "candidate",
"conclusion": "confirmed",
"new_observation": {
"test_id": "vulnerable-cross-user",
"category": "authorization",
"method": "GET",
"path": "/records/vulnerable/42",
"timestamp": "2026-10-27T12:24:31.116525+00:00",
"owner": {
"status": 200,
"body_sha256": "25b562d9bec6c7296370d66bb2a739bce7a06e7a2dbee859aababaece81f5468",
"body_bytes": 55,
"truncated": false,
"marker_present": true,
"security_headers": {
"content-type": "application/json"
}
},
"actor": {
"status": 200,
"body_sha256": "25b562d9bec6c7296370d66bb2a739bce7a06e7a2dbee859aababaece81f5468",
"body_bytes": 55,
"truncated": false,
"marker_present": true,
"security_headers": {
"content-type": "application/json"
}
},
"owner_precondition": true,
"expected_status": [
401,
403,
404
],
"violation": true,
"actor_identity": "configured-synthetic-actor",
"duration_seconds": 0.2101504170059343,
"limitations": "Expected policy and fixture ownership are supplied by the developer."
}
}
],
"cvss": null,
"engineering_guidance": {
"affected_component": "/records/vulnerable/42",
"root_cause": "Exact source-level cause is not established by the available evidence.",
"impact": "The configured lower-trust synthetic actor received the prohibited fixture response.",
"recommended_fix": "Enforce the configured ownership/role/input policy at the server-side resource boundary.",
"regression": "Run `appsec-lab verify --finding <id> --authorize` after fixing scenario vulnerable-cross-user; actor must be denied.",
"framework_context": {},
"compatibility": "Review existing callers and deployment controls; run application regression tests before release.",
"verification": "Repeat the recorded check with the same synthetic fixtures and verify both the denied actor and allowed owner controls.",
"alternative_mitigation": "Constrain the affected interface while a source correction is reviewed; deployment controls need independent validation.",
"references": [
"https://cwe.mitre.org/data/definitions/862.html"
]
}
}